What causes "digest parse of image %q failed: %w" in docker/cli?

Re-create the manifest list to repopulate descriptors: `docker manifest create --amend ...`.

digest parse of image

Error message

digest parse of image %q failed: %w

What it means

Returned by `buildManifestDescriptor` (push.go:163-165) when `manifest.Descriptor.Digest.Validate()` fails for a constituent image. The digest must be a syntactically valid digest (e.g. `sha256:<64 hex>`); an empty, malformed, or unknown-algorithm digest triggers this. The %w wraps the digest validation error.

Solutions

Re-create the manifest list to repopulate descriptors: `docker manifest create --amend ...`.
Clear the local manifest store for the affected list and rebuild.
Upgrade the Docker CLI to a version that writes complete descriptors.
Inspect the member to confirm whether the source image has a valid digest on the registry.

Example fix

# before
docker manifest push mylist   # a member has empty/invalid digest
# after
rm -rf ~/.local/share/docker/manifests/<encoded-list-name>
docker manifest create mylist img1 img2
docker manifest push mylist

Defensive patterns

Strategy: validation

Validate before calling

for _, m := range manifests {
    if err := m.Descriptor.Digest.Validate(); err != nil {
        return fmt.Errorf("member %s digest invalid: %w; rebuild the local list", m.Ref, err)
    }
}

Type guard

func validDigest(m types.ImageManifest) bool {
    return m.Descriptor.Digest.Validate() == nil
}

Try / catch

if err := runPush(ctx, cli, opts); err != nil {
    if strings.Contains(err.Error(), "digest parse of image") {
        // rebuild the list to repopulate descriptors
        return recreateListAndPush(targetRef)
    }
    return err
}

Prevention

Recreate the list if descriptors look stale.
Don't hand-edit the local manifest store.
Use a current CLI version that writes full digests.

When it happens

Trigger: A manifest entry whose stored digest is empty or corrupted, e.g. after a partial local-store write or a downgrade of the CLI storage format.

Common situations: Corrupted local manifest cache, a bug in an older CLI that stored an incomplete digest, or a manually-edited manifest store.

Related errors

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/65c476bfed39533d. Report an issue: GitHub.

Appendix: source

Thrown at cli/command/manifest/push.go:164

	if manifestRepoHostname != targetRepoHostname {
		return manifestlist.ManifestDescriptor{}, fmt.Errorf("cannot use source images from a different registry than the target image: %s != %s", manifestRepoHostname, targetRepoHostname)
	}

	manifest := manifestlist.ManifestDescriptor{
		Descriptor: distribution.Descriptor{
			Digest:    imageManifest.Descriptor.Digest,
			Size:      imageManifest.Descriptor.Size,
			MediaType: imageManifest.Descriptor.MediaType,
		},
	}

	platform := types.PlatformSpecFromOCI(imageManifest.Descriptor.Platform)
	if platform != nil {
		manifest.Platform = *platform
	}

	if err := manifest.Descriptor.Digest.Validate(); err != nil {
		return manifestlist.ManifestDescriptor{}, fmt.Errorf("digest parse of image %q failed: %w", imageManifest.Ref, err)
	}

	return manifest, nil
}

func buildBlobRequestList(imageManifest types.ImageManifest, repoName reference.Named) ([]manifestBlob, error) {
	blobs := imageManifest.Blobs()
	blobReqs := make([]manifestBlob, 0, len(blobs))
	for _, blobDigest := range blobs {
		canonical, err := reference.WithDigest(repoName, blobDigest)
		if err != nil {
			return nil, err
		}
		var os string
		if imageManifest.Descriptor.Platform != nil {
			os = imageManifest.Descriptor.Platform.OS
		}
		blobReqs = append(blobReqs, manifestBlob{canonical: canonical, os: os})

View on GitHub (pinned to 4f84911bfe)