docker_dn

#!/usr/bin/env bash
set -eo pipefail

# This script was developed for use in Moby's CI, and as such the use cases and
# usability are (intentionally) limited. You may find this script useful for
# educational purposes, for example, to learn how pulling images works "under
# the hood", and you may be able to use it for other purposes, but it should not
# be considered a "general purpose" tool for pulling images.
#
# The project maintainers accept contributions to this script within its intended
# scope, but may not accept contributions beyond that.
#
# For users who have a similar need but require more flexibility/functionality,
# refer to the discussion on GitHub, which mentions various alternatives that
# are more suitable for other uses: https://github.com/moby/moby/issues/40857

# hello-world                      latest              ef872312fe1b        3 months ago        910 B
# hello-world                      latest              ef872312fe1bbc5e05aae626791a47ee9b032efa8f3bda39cc0be7b56bfe59b9   3 months ago        910 B

# debian                           latest              f6fab3b798be        10 weeks ago        85.1 MB
# debian                           latest              f6fab3b798be3174f45aa1eb731f8182705555f89c9026d8c1ef230cbf8301dd   10 weeks ago        85.1 MB

# check if essential commands are in our PATH
for cmd in curl jq aria2c tar gzip docker; do
	if ! command -v "$cmd" &>/dev/null; then
		echo >&2 "error: \"$cmd\" not found!"
		exit 1
	fi
done

###########################################
# Cleanup on failure (#7)
###########################################
_download_complete=0
_cleanup() {
	local rc=$?
	if [ "$rc" -eq "$EX_DOWNLOAD" ] && [ "$_download_complete" -eq 0 ]; then
		echo >&2 "  partial download kept in '$dir' (can be resumed with same command)"
	fi
}
trap _cleanup EXIT
###########################################

# Exit codes
EX_OK=0       # success
EX_USAGE=1    # dependency missing / usage error
EX_AUTH=2     # auth failure
EX_DOWNLOAD=3 # download / checksum failure
EX_DOCKER=4   # docker load failure

VERSION="1.2.0"

# Colors (disabled when not a terminal or --quiet)
setup_colors() {
	if [ -t 1 ] && [ "${quiet:-0}" -eq 0 ]; then
		RED='\033[0;31m'
		GREEN='\033[0;32m'
		YELLOW='\033[0;33m'
		NC='\033[0m'
	else
		RED='' GREEN='' YELLOW='' NC=''
	fi
}

usage() {
	echo "usage: $0 -d dir -i image[:tag][@digest] ... [options]"
	echo "       $0 -d /tmp/old-hello-world -i hello-world:latest"
	echo ""
	echo "Options:"
	echo "  -d DIR        Output directory for downloading layers"
	echo "  -i IMAGE      Image name with optional tag/digest (can be repeated)"
	echo "  -f FILE       Read image list from file (one per line)"
	echo "  -o FILE       Archive output filename (default: <image>.tar.gz)"
	echo "  --proxy URL   Proxy URL for curl and aria2c (e.g. http://host:port)"
	echo "  --clean       Remove download directory after successful load"
	echo "  --no-load     Download and archive only, skip docker load"
	echo "  --dry-run     Show what would be downloaded, then exit"
	echo "  --verbose     Show debug output"
	echo "  --quiet       Suppress non-error output"
	echo "  --version     Show version"
	echo "  -h, -?        Show this help message"
	[ -z "$1" ] || exit "$1"
}

dir=
imageArgs=()
clean=0
noLoad=0
dryRun=0
proxyUrl=
archiveOut=
verbose=0
quiet=0

while [ $# -gt 0 ]; do
	case "$1" in
		-d)
			dir="$2"
			shift 2
			;;
		-i)
			imageArgs+=("$2")
			shift 2
			;;
		-f)
			if [ ! -f "$2" ]; then
				echo >&2 "error: file '$2' not found"
				exit $EX_USAGE
			fi
			while IFS= read -r line; do
				line="${line%%#*}"    # strip comments
				line="${line// /}"   # strip spaces
				[ -z "$line" ] && continue
				imageArgs+=("$line")
			done < "$2"
			shift 2
			;;
		-o)
			archiveOut="$2"
			shift 2
			;;
		--proxy)
			proxyUrl="$2"
			shift 2
			;;
		--clean)
			clean=1
			shift
			;;
		--no-load)
			noLoad=1
			shift
			;;
		--dry-run)
			dryRun=1
			shift
			;;
		--verbose)
			verbose=1
			shift
			;;
		--quiet)
			quiet=1
			shift
			;;
		--version | -v)
			echo "docker_dn $VERSION"
			exit $EX_OK
			;;
		-h | -?)
			usage 0
			;;
		*)
			echo >&2 "error: unknown option '$1'"
			usage $EX_USAGE >&2
			;;
	esac
done

# build proxy args for curl and aria2c
proxyArgs=()
if [ -n "$proxyUrl" ]; then
	proxyArgs=(--proxy "$proxyUrl")
fi

# initialize colors (needs quiet to be set)
setup_colors

# disk space check
check_disk_space() {
	local totalBytes="$1"
	local targetDir="$2"
	if [ "$totalBytes" -eq 0 ]; then return 0; fi
	local totalMB=$((totalBytes / 1024 / 1024))
	local availKB
	availKB="$(df -k "$targetDir" 2>/dev/null | awk 'NR==2{print $4}')"
	local availMB=$((availKB / 1024))
	if [ "$availMB" -lt "$totalMB" ]; then
		echo -e "${YELLOW}warning: estimated image size ${totalMB}MB exceeds available disk space ${availMB}MB${NC}" >&2
	fi
}

if [ -z "$dir" ] || [ ${#imageArgs[@]} -eq 0 ]; then
	echo >&2 "error: -d and -i are required"
	usage $EX_USAGE >&2
fi
mkdir -p "$dir"
touch "$dir/.done"

# pass collected images to the processing loop
set -- "${imageArgs[@]}"

# hacky workarounds for Bash 3 support (no associative arrays)
images=()
rm -f "$dir"/tags-*.tmp
manifestJsonEntries=()
doNotGenerateManifestJson=
# repositories[busybox]='"latest": "...", "ubuntu-14.04": "..."'

# bash v4 on Windows CI requires CRLF separator... and linux doesn't seem to care either way
newlineIFS=$'\n'
major=$(echo "${BASH_VERSION%%[^0.9]}" | cut -d. -f1)
if [ "$major" -ge 4 ]; then
	newlineIFS=$'\r\n'
fi

# Registry support: auto-detect from image prefix
# Supported: docker.io (default), ghcr.io, gcr.io, quay.io
detect_registry() {
	local fullImage="$1"
	registryType="docker.io"
	registryBase='https://registry-1.docker.io'
	authBase='https://auth.docker.io'
	authService='registry.docker.io'
	image="$fullImage"

	case "$fullImage" in
		ghcr.io/*)
			registryType="ghcr.io"
			registryBase='https://ghcr.io'
			authBase='https://ghcr.io'
			authService='ghcr.io'
			image="${fullImage#ghcr.io/}"
			;;
		gcr.io/*)
			registryType="gcr.io"
			registryBase='https://gcr.io'
			authBase='https://gcr.io'
			authService='gcr.io'
			image="${fullImage#gcr.io/}"
			;;
		quay.io/*)
			registryType="quay.io"
			registryBase='https://quay.io'
			authBase='https://quay.io'
			authService='quay.io'
			image="${fullImage#quay.io/}"
			;;
	esac

	# Docker Hub: add library/ prefix for official images
	if [ "$registryType" = "docker.io" ] && [[ "$image" != *"/"* ]]; then
		image="library/$image"
	fi
}

get_token() {
	local repoImage="$1"
	local tokenUrl
	case "${registryType:-docker.io}" in
		docker.io | ghcr.io)
			tokenUrl="$authBase/token?service=$authService&scope=repository:$repoImage:pull"
			;;
		gcr.io)
			tokenUrl="https://gcr.io/v2/token?scope=repository:$repoImage:pull&service=gcr.io"
			;;
		quay.io)
			tokenUrl="https://quay.io/v2/auth?scope=repository:$repoImage:pull"
			;;
	esac
	local curlFlags=(-fsSL)
	if [ "$quiet" -eq 1 ]; then curlFlags+=(-s); fi
	if [ "$verbose" -eq 1 ]; then curlFlags+=(-v); fi
	curl "${curlFlags[@]}" "${proxyArgs[@]}" "$tokenUrl" | jq --raw-output '.token'
}

# https://github.com/moby/moby/issues/33700
fetch_blob() {
	local token="$1"
	shift
	local image="$1"
	shift
	local digest="$1"
	shift
	local targetFile="$1"
	shift
	local quietMode="$1" # "-s" for silent (config files)

	# resume: skip if digest already recorded as done
	local digestHash="${digest#sha256:}"
	if [ -f "$dir/.done" ] && grep -q "^${digestHash}$" "$dir/.done" 2>/dev/null; then
		echo "  [resume] skipping ${digestHash:0:12}"
		return 0
	fi

	# skip if target file already exists and is non-empty
	if [ -s "$targetFile" ]; then
		echo "  [resume] skipping ${digestHash:0:12} (file exists)"
		echo "$digestHash" >> "$dir/.done"
		return 0
	fi

	# get response headers to detect redirect
	local httpHeaders
	httpHeaders="$(
		curl -sI \
			"${proxyArgs[@]}" \
			-H "Authorization: Bearer $token" \
			"$registryBase/v2/$image/blobs/$digest"
	)"
	httpHeaders="$(echo "$httpHeaders" | tr -d '\r')"

	local blobUrl
	case "$httpHeaders" in
		*"3"[0-9][0-9]*)
			blobUrl="$(echo "$httpHeaders" | awk -F ': ' 'tolower($1) == "location" { print $2; exit }')"
			if [ -z "$blobUrl" ]; then
				echo >&2 "error: failed fetching '$image' blob '$digest'"
				echo "$httpHeaders" | head -1 >&2
				return 1
			fi
			;;
		*)
			blobUrl="$registryBase/v2/$image/blobs/$digest"
			;;
	esac

	# download via aria2c
	local aria2Args=(-c -s16 -x16 -j4)
	if [ "$quiet" -eq 1 ] || [ "$quietMode" = "-s" ]; then
		aria2Args+=(--quiet)
	fi
	# redirect URLs (signed CDN) don't need auth header; direct URLs do
	case "$httpHeaders" in
		*"3"[0-9][0-9]*) ;;
		*) aria2Args+=("--header=Authorization: Bearer $token") ;;
	esac
	if [ -n "$proxyUrl" ]; then
		aria2Args+=("--all-proxy=$proxyUrl")
	fi
	aria2c "${aria2Args[@]}" "$blobUrl" -o "$targetFile"
	if [ $? -ne 0 ]; then
		echo >&2 "error: aria2c failed for blob ${digestHash:0:12}"
		return $EX_DOWNLOAD
	fi

	# checksum verification
	local expected="${digest#sha256:}"
	local actual
	actual="$(sha256sum "$targetFile" | cut -d' ' -f1)"
	if [ "$actual" != "$expected" ]; then
		echo >&2 "error: checksum mismatch for blob ${digestHash:0:12}"
		echo >&2 "  expected: $expected"
		echo >&2 "  actual:   $actual"
		rm -f "$targetFile"
		return $EX_DOWNLOAD
	fi

	# record success for resume
	echo "$digestHash" >> "$dir/.done"
}

# handle 'application/vnd.docker.distribution.manifest.v2+json' manifest
handle_single_manifest_v2() {
	local manifestJson="$1"
	shift

	# disk space check
	local totalBytes
	totalBytes="$(echo "$manifestJson" | jq '[.layers[].size] | add // 0')"
	check_disk_space "$totalBytes" "$dir"

	local configDigest
	configDigest="$(echo "$manifestJson" | jq --raw-output '.config.digest')"
	local imageId="${configDigest#*:}" # strip off "sha256:"

	# dry-run: show manifest info and return
	if [ "$dryRun" -eq 1 ]; then
		local layerCount
		layerCount="$(echo "$manifestJson" | jq '.layers | length')"
		local totalSizeMB=$((totalBytes / 1024 / 1024))
		echo -e "${GREEN}[dry-run]${NC} $imageIdentifier — ${layerCount} layers, ~${totalSizeMB}MB"
		local i=0
		while [ "$i" -lt "$layerCount" ]; do
			local lDigest lSize
			lDigest="$(echo "$manifestJson" | jq -r ".layers[$i].digest")"
			lSize="$(echo "$manifestJson" | jq ".layers[$i].size")"
			local lSizeMB=$((lSize / 1024 / 1024))
			echo "  [$((i+1))/${layerCount}] ${lDigest#sha256:0:12}  (~${lSizeMB}MB)"
			i=$((i + 1))
		done
		return 0
	fi

	local configFile="$imageId.json"
	fetch_blob "$token" "$image" "$configDigest" "$dir/$configFile" "-s"

	local layersFs
	layersFs="$(echo "$manifestJson" | jq --raw-output --compact-output '.layers[]')"
	local IFS="$newlineIFS"
	local layers
	mapfile -t layers <<<"$layersFs"
	unset IFS

	echo "Downloading '$imageIdentifier' (${#layers[@]} layers)..."
	local layerId=
	local layerFiles=()
	for i in "${!layers[@]}"; do
		local layerNum=$((i + 1))
		local layerMeta="${layers[$i]}"

		local layerMediaType
		layerMediaType="$(echo "$layerMeta" | jq --raw-output '.mediaType')"
		local layerDigest
		layerDigest="$(echo "$layerMeta" | jq --raw-output '.digest')"

		if [ "$quiet" -eq 0 ]; then
			echo "  [${layerNum}/${#layers[@]}] ${layerDigest#sha256:0:12}"
		fi

		# save the previous layer's ID
		local parentId="$layerId"
		# create a new fake layer ID based on this layer's digest and the previous layer's fake ID
		layerId="$(echo "$parentId"$'\n'"$layerDigest" | sha256sum | cut -d' ' -f1)"
		# this accounts for the possibility that an image contains the same layer twice (and thus has a duplicate digest value)

		mkdir -p "$dir/$layerId"
		echo '1.0' >"$dir/$layerId/VERSION"

		if [ ! -s "$dir/$layerId/json" ]; then
			local parentJson
			parentJson="$(printf ', parent: "%s"' "$parentId")"
			local addJson
			addJson="$(printf '{ id: "%s"%s }' "$layerId" "${parentId:+$parentJson}")"
			# this starter JSON is taken directly from Docker's own "docker save" output for unimportant layers
			jq "$addJson + ." >"$dir/$layerId/json" <<-'EOJSON'
				{
					"created": "0001-01-01T00:00:00Z",
					"container_config": {
						"Hostname": "",
						"Domainname": "",
						"User": "",
						"AttachStdin": false,
						"AttachStdout": false,
						"AttachStderr": false,
						"Tty": false,
						"OpenStdin": false,
						"StdinOnce": false,
						"Env": null,
						"Cmd": null,
						"Image": "",
						"Volumes": null,
						"WorkingDir": "",
						"Entrypoint": null,
						"OnBuild": null,
						"Labels": null
					}
				}
			EOJSON
		fi

		case "$layerMediaType" in
		application/vnd.oci.image.layer.v1.tar+gzip | application/vnd.docker.image.rootfs.diff.tar.gzip)
			local layerTar="$layerId/layer.tar"
			layerFiles=("${layerFiles[@]}" "$layerTar")
			# TODO figure out why "-C -" doesn't work here
			# "curl: (33) HTTP server doesn't seem to support byte ranges. Cannot resume."
			# "HTTP/1.1 416 Requested Range Not Satisfiable"
			if [ -f "$dir/$layerTar" ]; then
				if [ "$quiet" -eq 0 ]; then
					echo "  [${layerNum}/${#layers[@]}] skipping ${layerId:0:12}"
				fi
				continue
			fi
			local token
			token="$(get_token "$image")"
			fetch_blob "$token" "$image" "$layerDigest" "$dir/$layerTar"
			;;

		*)
			echo >&2 "error: unknown layer mediaType ($imageIdentifier, $layerDigest): '$layerMediaType'"
			exit 1
			;;
		esac
	done

	# change "$imageId" to be the ID of the last layer we added (needed for old-style "repositories" file which is created later -- specifically for older Docker daemons)
	imageId="$layerId"

	# munge the top layer image manifest to have the appropriate image configuration for older daemons
	local imageOldConfig
	imageOldConfig="$(jq --raw-output --compact-output '{ id: .id } + if .parent then { parent: .parent } else {} end' "$dir/$imageId/json")"
	jq --raw-output "$imageOldConfig + del(.history, .rootfs)" "$dir/$configFile" >"$dir/$imageId/json"

	local manifestJsonEntry
	manifestJsonEntry="$(
		echo '{}' | jq --raw-output --compact-output '. + {
			Config: "'"$configFile"'",
			RepoTags: ["'"${image#library\/}:$tag"'"],
			Layers: '"$(echo '[]' | jq --raw-output --compact-output ".$(for layerFile in "${layerFiles[@]}"; do echo " + [ \"$layerFile\" ]"; done)")"'
		}'
	)"
	manifestJsonEntries=("${manifestJsonEntries[@]}" "$manifestJsonEntry")
}

get_target_arch() {
	if [ -n "${TARGETARCH:-}" ]; then
		echo "${TARGETARCH}"
		return 0
	fi

	if type go >/dev/null; then
		go env GOARCH
		return 0
	fi

	if type dpkg >/dev/null; then
		debArch="$(dpkg --print-architecture)"
		case "${debArch}" in
		armel | armhf)
			echo "arm"
			return 0
			;;
		*64el)
			echo "${debArch%el}le"
			return 0
			;;
		*)
			echo "${debArch}"
			return 0
			;;
		esac
	fi

	if type uname >/dev/null; then
		uArch="$(uname -m)"
		case "${uArch}" in
		x86_64)
			echo amd64
			return 0
			;;
		arm | armv[0-9]*)
			echo arm
			return 0
			;;
		aarch64)
			echo arm64
			return 0
			;;
		mips*)
			echo >&2 "I see you are running on mips but I don't know how to determine endianness yet, so I cannot select a correct arch to fetch."
			echo >&2 "Consider installing \"go\" on the system which I can use to determine the correct arch or specify it explicitly by setting TARGETARCH"
			exit 1
			;;
		*)
			echo "${uArch}"
			return 0
			;;
		esac

	fi

	# default value
	echo >&2 "Unable to determine CPU arch, falling back to amd64. You can specify a target arch by setting TARGETARCH"
	echo amd64
}

get_target_variant() {
	echo "${TARGETVARIANT:-}"
}

while [ $# -gt 0 ]; do
	imageTag="$1"
	shift
	detect_registry "${imageTag%%[:@]*}"
	imageTag="${imageTag#*:}"
	digest="${imageTag##*@}"
	tag="${imageTag%%@*}"

	imageFile="${image//\//_}" # "/" can't be in filenames :)

	token="$(get_token "$image")"

	manifestJson="$(
		curl -fsSL \
			"${proxyArgs[@]}" \
			-H "Authorization: Bearer $token" \
			-H 'Accept: application/vnd.oci.image.manifest.v1+json' \
			-H 'Accept: application/vnd.oci.image.index.v1+json' \
			-H 'Accept: application/vnd.docker.distribution.manifest.v2+json' \
			-H 'Accept: application/vnd.docker.distribution.manifest.list.v2+json' \
			-H 'Accept: application/vnd.docker.distribution.manifest.v1+json' \
			"$registryBase/v2/$image/manifests/$digest"
	)"
	if [ "${manifestJson:0:1}" != '{' ]; then
		echo >&2 "error: /v2/$image/manifests/$digest returned something unexpected:"
		echo >&2 "  $manifestJson"
		exit 1
	fi

	imageIdentifier="$image:$tag@$digest"

	schemaVersion="$(echo "$manifestJson" | jq --raw-output '.schemaVersion')"
	case "$schemaVersion" in
	2)
		mediaType="$(echo "$manifestJson" | jq --raw-output '.mediaType')"

		case "$mediaType" in
		application/vnd.oci.image.manifest.v1+json | application/vnd.docker.distribution.manifest.v2+json)
			handle_single_manifest_v2 "$manifestJson"
			;;
		application/vnd.oci.image.index.v1+json | application/vnd.docker.distribution.manifest.list.v2+json)
			layersFs="$(echo "$manifestJson" | jq --raw-output --compact-output '.manifests[]')"
			IFS="$newlineIFS"
			mapfile -t layers <<<"$layersFs"
			unset IFS

			found=""
			targetArch="$(get_target_arch)"
			targetVariant="$(get_target_variant)"
			# parse first level multi-arch manifest
			for i in "${!layers[@]}"; do
				layerMeta="${layers[$i]}"
				maniArch="$(echo "$layerMeta" | jq --raw-output '.platform.architecture')"
				maniVariant="$(echo "$layerMeta" | jq --raw-output '.platform.variant')"
				if [[ "$maniArch" = "${targetArch}" ]] && [[ -z "${targetVariant}" || "$maniVariant" = "${targetVariant}" ]]; then
					digest="$(echo "$layerMeta" | jq --raw-output '.digest')"
					# get second level single manifest
					submanifestJson="$(
						curl -fsSL \
							"${proxyArgs[@]}" \
							-H "Authorization: Bearer $token" \
							-H 'Accept: application/vnd.oci.image.manifest.v1+json' \
							-H 'Accept: application/vnd.oci.image.index.v1+json' \
							-H 'Accept: application/vnd.docker.distribution.manifest.v2+json' \
							-H 'Accept: application/vnd.docker.distribution.manifest.list.v2+json' \
							-H 'Accept: application/vnd.docker.distribution.manifest.v1+json' \
							"$registryBase/v2/$image/manifests/$digest"
					)"
					handle_single_manifest_v2 "$submanifestJson"
					found="found"
					break
				fi
			done
			if [ -z "$found" ]; then
				echo >&2 "error: manifest for ${targetArch}${targetVariant:+/${targetVariant}} is not found"
				exit 1
			fi
			;;
		*)
			echo >&2 "error: unknown manifest mediaType ($imageIdentifier): '$mediaType'"
			exit 1
			;;
		esac
		;;

	1)
		if [ -z "$doNotGenerateManifestJson" ]; then
			echo -e "${YELLOW}warning: '$imageIdentifier' uses schemaVersion '$schemaVersion'${NC}" >&2
			echo >&2 "  this script cannot (currently) recreate the 'image config' to put in a 'manifest.json' (thus any schemaVersion 2+ images will be imported in the old way, and their 'docker history' will suffer)"
			echo >&2
			doNotGenerateManifestJson=1
		fi

		layersFs="$(echo "$manifestJson" | jq --raw-output '.fsLayers | .[] | .blobSum')"
		IFS="$newlineIFS"
		mapfile -t layers <<<"$layersFs"
		unset IFS

		# dry-run: show manifest info and return
		if [ "$dryRun" -eq 1 ]; then
			echo -e "${GREEN}[dry-run]${NC} $imageIdentifier — ${#layers[@]} layers (schema v1, size unknown)"
			for li in "${!layers[@]}"; do
				echo "  [$((li+1))/${#layers[@]}] ${layers[$li]#sha256:0:12}"
			done
			continue
		fi

		history="$(echo "$manifestJson" | jq '.history | [.[] | .v1Compatibility]')"
		imageId="$(echo "$history" | jq --raw-output '.[0]' | jq --raw-output '.id')"

		echo "Downloading '$imageIdentifier' (${#layers[@]} layers)..."
		for i in "${!layers[@]}"; do
			local layerNum=$((i + 1))
			imageJson="$(echo "$history" | jq --raw-output ".[${i}]")"
			layerId="$(echo "$imageJson" | jq --raw-output '.id')"
			imageLayer="${layers[$i]}"

			if [ "$quiet" -eq 0 ]; then
				echo "  [${layerNum}/${#layers[@]}] ${imageLayer#sha256:0:12}"
			fi

			mkdir -p "$dir/$layerId"
			echo '1.0' >"$dir/$layerId/VERSION"

			echo "$imageJson" >"$dir/$layerId/json"

			# TODO figure out why "-C -" doesn't work here
			# "curl: (33) HTTP server doesn't seem to support byte ranges. Cannot resume."
			# "HTTP/1.1 416 Requested Range Not Satisfiable"
			if [ -f "$dir/$layerId/layer.tar" ]; then
				if [ "$quiet" -eq 0 ]; then
					echo "  [${layerNum}/${#layers[@]}] skipping ${layerId:0:12}"
				fi
				continue
			fi
			token="$(get_token "$image")"
			fetch_blob "$token" "$image" "$imageLayer" "$dir/$layerId/layer.tar"
		done
		;;

	*)
		echo >&2 "error: unknown manifest schemaVersion ($imageIdentifier): '$schemaVersion'"
		exit 1
		;;
	esac

	echo

	if [ -s "$dir/tags-$imageFile.tmp" ]; then
		echo -n ', ' >>"$dir/tags-$imageFile.tmp"
	else
		images=("${images[@]}" "$image")
	fi
	echo -n '"'"$tag"'": "'"$imageId"'"' >>"$dir/tags-$imageFile.tmp"
done

echo -n '{' >"$dir/repositories"
firstImage=1
for image in "${images[@]}"; do
	imageFile="${image//\//_}" # "/" can't be in filenames :)
	image="${image#library\/}"

	[ "$firstImage" ] || echo -n ',' >>"$dir/repositories"
	firstImage=
	echo -n $'\n\t' >>"$dir/repositories"
	echo -n '"'"$image"'": { '"$(cat "$dir/tags-$imageFile.tmp")"' }' >>"$dir/repositories"
done
echo -n $'\n}\n' >>"$dir/repositories"

rm -f "$dir"/tags-*.tmp

if [ -z "$doNotGenerateManifestJson" ] && [ "${#manifestJsonEntries[@]}" -gt 0 ]; then
	echo '[]' | jq --raw-output ".$(for entry in "${manifestJsonEntries[@]}"; do echo " + [ $entry ]"; done)" >"$dir/manifest.json"
else
	rm -f "$dir/manifest.json"
fi

echo -e "${GREEN}Download of images into '$dir' complete.${NC}"

########################################################################################################
# archive, load, cleanup
########################################################################################################
if [ "$dryRun" -eq 0 ]; then
	_download_complete=1
	imageFile="${image//\//_}"
	archiveName="${archiveOut:-${imageFile}.tar.gz}"
	if [ "$quiet" -eq 0 ]; then
		tar -cvC "${dir}" . | gzip -c -9 >"${archiveName}"
	else
		tar -cC "${dir}" . | gzip -c -9 >"${archiveName}"
	fi
	echo -e "${GREEN}Archive saved: ${archiveName}${NC}"

	if [ "$noLoad" -eq 0 ]; then
		if ! docker info &>/dev/null; then
			echo -e "${YELLOW}warning: Docker daemon not reachable, skipping load${NC}" >&2
		else
			docker load -i "${archiveName}"
			if [ $? -ne 0 ]; then
				echo >&2 "error: docker load failed"
				exit $EX_DOCKER
			fi
		fi
	fi

	# cleanup
	if [ "$clean" -eq 1 ]; then
		rm -rf "${dir}"
	fi
fi

# remove .done file on success (no longer needed)
rm -f "$dir/.done"
########################################################################################################

exit $EX_OK