how does buildx calculates digest before pushing to registry?

[Horiodino]

i am trying to generate a digest manually , but cant replicate . how does buildx or docker generates digest before pushing to registry.

[wellkilo]

The digest is not calculated from the Dockerfile or the uncompressed filesystem. It is the OCI/Docker content digest of the exact serialized object uploaded to the registry:

sha256(canonical_manifest_or_index_bytes)

For a single-platform image, hash the exact manifest JSON bytes. That manifest contains the config digest and compressed layer digests, so compression settings, timestamps/history, media types, platform metadata, annotations, provenance/SBOM attestations, and even JSON serialization can change it. For a multi-platform image, the top-level digest is the digest of the OCI index / Docker manifest list, whose entries point to platform manifests (and possibly attestations).

The reliable way to reproduce it is to obtain the raw manifest bytes and hash those bytes without parsing/re-serializing them:

docker buildx imagetools inspect --raw registry.example/image:tag > manifest.json
sha256sum manifest.json

Or use the registry API with an Accept header covering OCI indexes/manifests and hash the raw response body. The registry's Docker-Content-Digest header is the authoritative digest.

Before pushing, BuildKit can report a digest for an exported result, but it will only match the eventual registry object if the exporter produces identical bytes and the registry does not convert media types. The common failure in “manual” attempts is hashing pretty-printed or re-encoded JSON rather than the exact bytes, or hashing a platform manifest while comparing it with the multi-arch index digest.