We use a Quay instance for hosting container images internally. We use the Repository Mirroring function to mirror images and repositories from external registries, eg from

docker.io and redhat.io

Mirroring of the images seems to work fine, but we notice that the images that are mirrored have different sha256 digests compared to the original images/tags.

This presents an issue for us since we run most of our OpenShift cluster disconnected (or air-gapped). We use OpenShift with operators, and some operators (for example CodeReadyWorkspaces) pull images based on the digest and not based an a repo/tag value. Thus the installation of these operators fail because the looked-for digests are not available in our internal Quay repository.

We want to know whether this behaviour is by design (I mean the changing of the digests using the mirroring function of Quay) and whether perhaps we can change this behaviour or suppress the creation of a new digest?

Steps to reproduce:

$ skopeo copy docker://registry.redhat.io/rhscl/postgresql-96-rhel7:1-47  docker://quay.io/ivancherepov/myfirstrepo:v1

$ skopeo inspect  docker://quay.io/ivancherepov/myfirstrepo:v1 | jq -r '.Digest'
sha256:ffd9b8e71e72a351464f54c3ad2f9151c17a45c089aeb4db1083f9c1c3c3a142

$ skopeo inspect docker://registry.redhat.io/rhscl/postgresql-96-rhel7:1-47  | jq  -r '.Digest'
sha256:196abd9a1221fb38dd5693203f068fc4d520bb351928ef84e5e15984f5152476