docker buildx imagetools inspect
docker buildx imagetools inspect <image>
Risk: Safe
What it does
Reads an image in a registry: its digest, platforms and attestations.
When to use it
To see the SBOM and provenance that travel with an image.
Example
$ docker buildx imagetools inspect ghcr.io/you/kedai-api:1.0Digest, platforms and attestation manifests.
$ docker buildx imagetools inspect ghcr.io/you/kedai-api:1.0 --format '{{ json .SBOM.SPDX }}'The SBOM: every package inside.
$ docker buildx imagetools inspect ghcr.io/you/kedai-api:1.0 --format '{{ json .Provenance.SLSA }}'The provenance: how it was built.
Learn it in: SBOM, provenance and signing · Official docs