fivenines
15/40
Lesson 15 · Distribution

Pull, End to End

In one sentence: A pull is manifest-first: fetch the small index, diff its layer list against the local store, download only the missing blobs in parallel, verify each by digest, then extract in order.

You already know

  • From Lesson 14: manifests by name, blobs by digest — separate endpoints.
  • From Lesson 13: the layer store knows which diffs already exist locally.
  • From Lesson 8: a verified digest makes the transport untrusted-but-safe.

Small file first, big files maybe

The manifest-first order is what makes pulls fast in practice. The manifest is a few KB and lists every blob digest, so before downloading anything heavy the engine can ask its layer store "which of these do I already have?" Pulling api:2.2 when you have api:2.1 typically means one changed app layer — a 40 MB download instead of 800. The missing blobs have no ordering dependencies (they're just bytes) so they download in parallel; only extraction must run bottom-up, because each layer's directory is stacked on its parent (Lesson 9).

Architecture — what a pull touches
flowchart LR
  E["engine (pull api:2.2)"]
  R["registry"]
  LS[("layer store")]
  RS[("reference store")]
  E -- "1· GET manifest (small)" --> R
  E -- "2· which layers are new?" --> LS
  E -- "3· GET missing blobs
(parallel)" --> R E -- "4· verify + extract
(bottom-up)" --> LS E -- "5· record api:2.2 → digest" --> RS
Sequence — pulling with a warm local store
sequenceDiagram
  participant E as Engine
  participant R as Registry
  participant LS as Layer store
  E->>R: GET /v2/api/manifests/2.2
  R-->>E: manifest (layers: base 77ff, runtime 88aa, app 33cc)
  E->>LS: have 77ff? 88aa? 33cc?
  LS-->>E: have base + runtime; missing app 33cc
  par only the missing blob, in parallel with any others
    E->>R: GET /v2/api/blobs/sha256:33cc
    R-->>E: 40 MB
  end
  E->>E: re-hash — matches 33cc ✓
  E->>LS: extract 33cc atop runtime chain
  E->>E: record tag api:2.2 → manifest digest
    

Anchor these

  • Manifest first: a KB-sized index decides what the MB-sized downloads are.
  • Diff against the local store before downloading — shared layers transfer zero bytes.
  • Download in parallel, verify every blob, extract bottom-up, tag last.
Next step

See what actually stuck.

Take the practice scenarios now.