flowchart TB
    subgraph API["API 层"]
        ImageRouter[Image Router]
    end
    
    subgraph ImageService["镜像服务"]
        ImageSvc[ImageService]
        PullSvc[拉取服务]
        PushSvc[推送服务]
        BuildSvc[构建服务]
    end
    
    subgraph Storage["存储层"]
        ContentStore[内容存储<br/>Content Store]
        ImageStore[镜像存储<br/>Image Store]
        LayerStore[层存储<br/>Layer Store]
        RefStore[引用存储<br/>Reference Store]
    end
    
    subgraph Distribution["分发层"]
        Puller[镜像拉取器]
        Pusher[镜像推送器]
        Registry[Registry 客户端]
        ManifestService[Manifest 服务]
    end
    
    subgraph Builder["构建层"]
        DockerfileParser[Dockerfile 解析器]
        BuildKit[BuildKit 引擎]
        BuilderBackend[Builder Backend]
    end
    
    ImageRouter --> ImageSvc
    ImageSvc --> PullSvc
    ImageSvc --> PushSvc
    ImageSvc --> BuildSvc
    
    PullSvc --> Puller
    PushSvc --> Pusher
    Puller --> Registry
    Pusher --> Registry
    Registry --> ManifestService
    
    Puller --> ContentStore
    ContentStore --> ImageStore
    ImageStore --> LayerStore
    LayerStore --> RefStore
    
    BuildSvc --> BuilderBackend
    BuilderBackend --> DockerfileParser
    BuilderBackend --> BuildKit
    BuildKit --> PullSvc
    BuildKit --> ContentStore

**2. 存储层**：

- **Content Store**：内容寻址存储，以 SHA256 为 key

- **Image Store**：存储镜像元数据（配置、层列表）

  ```json
  {
    "id": "sha256:abc123...",
    "parent": "sha256:def456...",
    "created": "2023-01-01T00:00:00Z",
    "container_config": {...},
    "rootfs": {
      "type": "layers",
      "diff_ids": [
        "sha256:layer1...",
        "sha256:layer2..."
      ]
    }
  }

- **Reference Store**：tag → digest 映射

**3. 分发层**：

- **Puller**：镜像拉取器
  - 下载 manifest（清单）
  - 解析层列表
  - 并发下载层（限制并发数）
  - 验证层完整性（SHA256）
  - 解压并存储层

- **Pusher**：镜像推送器
  - 检查远程仓库已存在的层（blob mount）
  - 并发上传缺失的层
  - 上传镜像配置
  - 上传 manifest

- **Registry 客户端**：
  - 实现 Registry V2 API
  - 支持 token 认证
  - 支持 HTTP/HTTPS
  - 镜像仓库镜像（mirrors）

**4. 构建层**：

- **Dockerfile 解析器**：
  - 词法分析与语法分析
  - 指令验证（FROM/RUN/COPY/...）
  - 多阶段构建解析

- **BuildKit**：
  - 并行构建（independent stages）
  - 高效缓存（cache mounts）
  - 远程缓存导入/导出
  - 多平台构建

---

## 镜像拉取完整时序图

```mermaid
sequenceDiagram
    autonumber
    participant Client as docker CLI
    participant Router as Image Router
    participant ImageSvc as ImageService
    participant Registry as Registry Client
    participant ContentStore as Content Store
    participant LayerStore as Layer Store
    participant Puller as Layer Puller
    
    Note over Client: docker pull nginx:latest
    Client->>Router: POST /images/create?fromImage=nginx&tag=latest
    Router->>ImageSvc: PullImage(ref, options)
    
    Note over ImageSvc: 阶段1: 解析引用
    ImageSvc->>ImageSvc: ParseReference("nginx:latest")
    ImageSvc->>ImageSvc: 转换为 docker.io/library/nginx:latest
    
    Note over ImageSvc: 阶段2: 认证
    ImageSvc->>Registry: GetAuthToken(repository)
    Registry->>Registry: 从 Docker Hub 获取 token
    Registry-->>ImageSvc: Bearer token
    
    Note over ImageSvc: 阶段3: 拉取 Manifest
    ImageSvc->>Registry: GET /v2/library/nginx/manifests/latest
    Registry-->>ImageSvc: Manifest (JSON)
    
    Note over ImageSvc: 解析 Manifest
    ImageSvc->>ImageSvc: 检查 mediaType
    alt Manifest List (多平台)
        ImageSvc->>ImageSvc: 选择匹配平台
        ImageSvc->>Registry: GET /v2/.../manifests/<digest>
        Registry-->>ImageSvc: Platform Manifest
    end
    
    ImageSvc->>ImageSvc: 提取层列表
    Note over ImageSvc: layers = [sha256:abc..., sha256:def...]
    
    Note over ImageSvc: 阶段4: 检查本地已存在层
    loop 遍历每层
        ImageSvc->>ContentStore: Exists(digest)
        alt 层已存在
            ContentStore-->>ImageSvc: true (跳过下载)
        else 层不存在
            ContentStore-->>ImageSvc: false (需要下载)
            ImageSvc->>Puller: AddLayer(digest)
        end
    end
    
    Note over ImageSvc: 阶段5: 并发下载层
    par 并发下载（max 3）
        Puller->>Registry: GET /v2/.../blobs/sha256:abc...
        Registry-->>Puller: Layer Blob (chunked)
        Puller->>Puller: 计算 SHA256
        Puller->>ContentStore: Ingest(digest, data)
        ContentStore->>ContentStore: 写入临时文件
    and
        Puller->>Registry: GET /v2/.../blobs/sha256:def...
        Registry-->>Puller: Layer Blob
        Puller->>ContentStore: Ingest(digest, data)
    and
        Puller->>Registry: GET /v2/.../blobs/sha256:ghi...
        Registry-->>Puller: Layer Blob
        Puller->>ContentStore: Ingest(digest, data)
    end
    
    Note over Puller: 阶段6: 验证与提交
    loop 每个下载的层
        Puller->>Puller: 验证 SHA256 匹配
        alt SHA256 匹配
            Puller->>ContentStore: Commit(digest)
            ContentStore->>ContentStore: 移动到最终位置
            ContentStore->>ContentStore: 更新索引
        else SHA256 不匹配
            Puller->>Puller: 删除临时文件
            Puller-->>ImageSvc: 下载错误
        end
    end
    
    Note over ImageSvc: 阶段7: 解压层到 LayerStore
    loop 遍历每层
        ImageSvc->>ContentStore: Open(digest)
        ContentStore-->>ImageSvc: io.ReadCloser
        ImageSvc->>LayerStore: Register(diffID, parent)
        LayerStore->>LayerStore: 解压 tar.gz
        LayerStore->>LayerStore: 应用到存储驱动 (overlay2)
        LayerStore->>LayerStore: 计算 ChainID
        LayerStore-->>ImageSvc: Layer 对象
    end
    
    Note over ImageSvc: 阶段8: 创建镜像对象
    ImageSvc->>ImageSvc: 构建镜像元数据
    ImageSvc->>ImageSvc: 保存镜像配置
    ImageSvc->>ImageSvc: 更新引用 (nginx:latest → digest)
    
    Note over ImageSvc: 阶段9: 清理临时资源
    ImageSvc->>ImageSvc: 释放临时 lease
    
    ImageSvc-->>Router: 拉取成功
    Router-->>Client: 200 OK + 进度流
    
    Note over Client: 输出示例
    Note over Client: latest: Pulling from library/nginx<br/>a2abf6c4d29d: Pull complete<br/>dcc4698797c8: Pull complete<br/>Digest: sha256:abc123...<br/>Status: Downloaded newer image for nginx:latest

func ParseReference(ref string) (reference.Named, error) {
    // 补全隐式部分
    // nginx → docker.io/library/nginx:latest
    // myregistry.com/myimage → myregistry.com/myimage:latest
    
    named, err := reference.ParseNormalizedNamed(ref)
    return reference.TagNameOnly(named), nil
}

  
  - **Manifest List**：多平台镜像

    ```json
    {
      "schemaVersion": 2,
      "mediaType": "application/vnd.docker.distribution.manifest.list.v2+json",
      "manifests": [
        {
          "digest": "sha256:amd64-digest...",
          "platform": {"architecture": "amd64", "os": "linux"}
        },
        {
          "digest": "sha256:arm64-digest...",
          "platform": {"architecture": "arm64", "os": "linux"}
        }
      ]
    }

func (s *ImageService) filterExistingLayers(descriptors []ocispec.Descriptor) []ocispec.Descriptor {
    var missing []ocispec.Descriptor
    for _, desc := range descriptors {
        exists, err := s.contentStore.Exists(desc.Digest)
        if err != nil || !exists {
            missing = append(missing, desc)
        }
    }
    return missing
}

- **断点续传**：
  - Registry 支持 HTTP Range 请求
  - 记录已下载字节数
  - 失败后从断点继续

- **进度报告**：

  ```go
  type Progress struct {
      ID     string  // 层 ID（短格式）
      Status string  // "Downloading" / "Extracting" / "Pull complete"
      Current int64  // 当前字节数
      Total   int64  // 总字节数
  }

func (cs *contentStore) Commit(digest string, data io.Reader) error {
    // 计算实际 hash
    h := sha256.New()
    tee := io.TeeReader(data, h)
    
    // 写入临时文件
    tmpFile := filepath.Join(cs.ingestRoot, digest+".tmp")
    io.Copy(tmpFile, tee)
    
    // 验证 hash
    actualDigest := h.Sum(nil)
    if hex.EncodeToString(actualDigest) != digest {
        return errors.New("digest mismatch")
    }
    
    // 原子移动到最终位置
    finalPath := filepath.Join(cs.blobRoot, digest[:2], digest)
    os.Rename(tmpFile, finalPath)
    
    return nil
}

func (ls *layerStore) Register(diffID DiffID, parent ChainID) (Layer, error) {
    // 计算 ChainID
    chainID := createChainID(parent, diffID)
    
    // 从 content store 读取压缩层
    reader := ls.contentStore.Open(diffID)
    defer reader.Close()
    
    // 解压到存储驱动
    cacheID := generateCacheID()
    ls.driver.ApplyDiff(cacheID, parent, reader)
    
    // 保存元数据
    layer := &Layer{
        ChainID: chainID,
        DiffID:  diffID,
        Parent:  parent,
        CacheID: cacheID,
    }
    ls.save(layer)
    
    return layer, nil
}

  ChainID = SHA256(parent_chainID + " " + diffID)

func (s *ImageService) createImage(config ImageConfig, layers []Layer) (Image, error) {
    // 计算镜像 ID（配置的 SHA256）
    imageID := sha256.Sum(marshalImageConfig(config))
    
    // 保存镜像配置
    s.imageStore.Set(imageID, config)
    
    // 创建引用（tag → imageID）
    ref, _ := reference.WithTag("nginx", "latest")
    s.referenceStore.AddTag(ref, imageID, false)
    
    return Image{ID: imageID, Layers: layers}, nil
}

sequenceDiagram
    autonumber
    participant Client as docker CLI
    participant Router as Build Router
    participant Builder as Builder Backend
    participant Parser as Dockerfile Parser
    participant ImageSvc as Image Service
    participant Container as Container Manager
    participant Containerd as containerd
    
    Note over Client: docker build -t myapp:v1.0 .
    Client->>Router: POST /build
    Router->>Builder: Build(context, options)
    
    Note over Builder: 阶段1: 上传构建上下文
    Client->>Builder: 上传 tar 归档
    Builder->>Builder: 解压到临时目录
    
    Note over Builder: 阶段2: 解析 Dockerfile
    Builder->>Parser: Parse(dockerfile)
    Parser->>Parser: 词法分析
    Parser->>Parser: 语法分析
    Parser-->>Builder: 指令列表
    
    Note over Builder: 阶段3: 逐指令构建
    loop 遍历每条指令
        alt 指令 = FROM
            Builder->>ImageSvc: GetImage(baseImage)
            ImageSvc-->>Builder: 基础镜像
            Builder->>Builder: 创建构建容器
        else 指令 = RUN
            Builder->>Container: Create(config)
            Container-->>Builder: 容器 ID
            Builder->>Container: Start(containerID)
            Builder->>Container: Attach(containerID)
            Container->>Containerd: Exec(command)
            Containerd-->>Container: 命令输出
            Container-->>Builder: 命令退出码
            Builder->>Container: Stop(containerID)
            Builder->>ImageSvc: Commit(containerID)
            ImageSvc->>ImageSvc: 创建新镜像层
            ImageSvc-->>Builder: 新层 ID
        else 指令 = COPY
            Builder->>Builder: 复制文件到容器
            Builder->>ImageSvc: Commit(changes)
            ImageSvc-->>Builder: 新层 ID
        else 指令 = ENV/EXPOSE/...
            Builder->>Builder: 更新镜像配置
        end
    end
    
    Note over Builder: 阶段4: 生成最终镜像
    Builder->>ImageSvc: CreateImage(config, layers)
    ImageSvc->>ImageSvc: 计算镜像 ID
    ImageSvc->>ImageSvc: 添加 tag (myapp:v1.0)
    ImageSvc-->>Builder: 镜像 ID
    
    Builder-->>Router: 构建成功
    Router-->>Client: 200 OK + 构建日志
    
    Note over Client: 输出示例
    Note over Client: Step 1/5 : FROM golang:1.20<br/>Step 2/5 : WORKDIR /app<br/>Step 3/5 : COPY . .<br/>Step 4/5 : RUN go build<br/>Step 5/5 : CMD ["./myapp"]<br/>Successfully built abc123...<br/>Successfully tagged myapp:v1.0

// 限制并发下载数
const maxConcurrentDownloads = 3

// 按层大小排序（先下载小层）
sort.Slice(layers, func(i, j int) bool {
    return layers[i].Size < layers[j].Size
})

// 并发下载
var wg sync.WaitGroup
sem := semaphore.NewWeighted(maxConcurrentDownloads)
for _, layer := range layers {
    wg.Add(1)
    sem.Acquire(ctx, 1)
    go func(l Layer) {
        defer wg.Done()
        defer sem.Release(1)
        downloadLayer(l)
    }(layer)
}
wg.Wait()

// BuildKit 缓存挂载
RUN --mount=type=cache,target=/go/pkg/mod \
    go mod download

RUN --mount=type=cache,target=/root/.cache/go-build \
    go build -o /app

{
  "registry-mirrors": [
    "https://mirror.gcr.io",
    "https://registry.docker-cn.com"
  ]
}

# 使用多阶段构建
FROM golang:1.20 AS builder
WORKDIR /app
COPY . .
RUN go build -o /bin/myapp

FROM alpine:latest
COPY --from=builder /bin/myapp /usr/local/bin/
CMD ["myapp"]

# 先复制依赖文件（变化少）
COPY go.mod go.sum ./
RUN go mod download

# 后复制源代码（变化多）
COPY . .
RUN go build

.git
.gitignore
*.md
node_modules/
__pycache__/
*.pyc

func (ir *imageRouter) initRoutes() {
    ir.routes = []router.Route{
        router.NewGetRoute("/images/json", ir.getImagesJSON),
        router.NewGetRoute("/images/search", ir.getImagesSearch),
        router.NewGetRoute("/images/get", ir.getImagesGet),
        router.NewGetRoute("/images/{name:.*}/history", ir.getImagesHistory),
        router.NewGetRoute("/images/{name:.*}/json", ir.getImagesByName),
        router.NewPostRoute("/images/load", ir.postImagesLoad),
        router.NewPostRoute("/images/create", ir.postImagesCreate),
        router.NewPostRoute("/images/{name:.*}/push", ir.postImagesPush),
        router.NewPostRoute("/images/{name:.*}/tag", ir.postImagesTag),
        router.NewDeleteRoute("/images/{name:.*}", ir.deleteImages),
    }
}

func (ir *imageRouter) postImagesCreate(ctx context.Context, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
    w.Header().Set("Content-Type", "application/json")
    version := httputils.VersionFromContext(ctx)
    var platform *ocispec.Platform
    if versions.GreaterThanOrEqualTo(version, "1.32") {
        if p := r.FormValue("platform"); p != "" {
            sp, err := platforms.Parse(p)
            if err != nil { return errdefs.InvalidParameter(err) }
            platform = &sp
        }
    }
    // 省略: 解析 fromImage/ref、tag/digest、X-Registry-Auth、流式输出
    return nil
}

{
  "dangling": ["true"],
  "label": ["version=1.0", "env=prod"],
  "before": ["image:latest"],
  "since": ["image:1.0"],
  "reference": ["nginx:*", "redis:alpine"],
  "until": ["2h", "2023-01-01T00:00:00"]
}

[
  {
    "Id": "sha256:abc123def456...",
    "ParentId": "sha256:parent123...",
    "RepoTags": [
      "nginx:latest",
      "nginx:1.21"
    ],
    "RepoDigests": [
      "nginx@sha256:digest123..."
    ],
    "Created": 1678886400,
    "Size": 133521408,
    "SharedSize": 67108864,
    "VirtualSize": 133521408,
    "Labels": {
      "maintainer": "NGINX Docker Maintainers"
    },
    "Containers": 2,
    "Descriptor": {
      "mediaType": "application/vnd.oci.image.index.v1+json",
      "digest": "sha256:...",
      "size": 1234
    }
  }
]

// API Handler
func (ir *imageRouter) getImagesJSON(ctx context.Context, w http.ResponseWriter, r *http.Request) error {
    imageFilters, err := filters.FromJSON(r.Form.Get("filters"))
    
    sharedSize := httputils.BoolValue(r, "shared-size")
    manifests := httputils.BoolValue(r, "manifests")
    
    images, err := ir.backend.Images(ctx, imagebackend.ListOptions{
        All:        httputils.BoolValue(r, "all"),
        Filters:    imageFilters,
        SharedSize: sharedSize,
        Manifests:  manifests,
    })
    
    return httputils.WriteJSON(w, http.StatusOK, images)
}

// Backend Implementation
func (i *ImageService) Images(ctx context.Context, opts imagebackend.ListOptions) ([]*imagetypes.Summary, error) {
    // 1. 获取所有镜像
    images := i.getAllImages(ctx)
    
    // 2. 应用过滤器
    images = i.filterImages(images, opts.Filters)
    
    // 3. 计算大小
    for _, img := range images {
        img.Size = i.calculateSize(img.ID)
        if opts.SharedSize {
            img.SharedSize = i.calculateSharedSize(img.ID)
        }
    }
    
    // 4. 获取容器数量
    for _, img := range images {
        img.Containers = i.countContainersUsingImage(img.ID)
    }
    
    return images, nil
}

{
  "Id": "sha256:abc123def456...",
  "RepoTags": ["nginx:latest"],
  "RepoDigests": ["nginx@sha256:digest123..."],
  "Parent": "",
  "Comment": "",
  "Created": "2023-01-01T00:00:00.000000000Z",
  "DockerVersion": "20.10.21",
  "Author": "",
  "Config": {
    "Hostname": "",
    "Env": [
      "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
      "NGINX_VERSION=1.21.6"
    ],
    "Cmd": ["nginx", "-g", "daemon off;"],
    "Image": "sha256:parent123...",
    "Volumes": null,
    "WorkingDir": "",
    "Entrypoint": ["/docker-entrypoint.sh"],
    "Labels": {
      "maintainer": "NGINX Docker Maintainers"
    },
    "StopSignal": "SIGQUIT",
    "ExposedPorts": {
      "80/tcp": {}
    }
  },
  "Architecture": "amd64",
  "Variant": "",
  "Os": "linux",
  "Size": 133521408,
  "GraphDriver": {
    "Name": "overlay2",
    "Data": {
      "LowerDir": "/var/lib/docker/overlay2/.../diff",
      "MergedDir": "/var/lib/docker/overlay2/.../merged",
      "UpperDir": "/var/lib/docker/overlay2/.../diff",
      "WorkDir": "/var/lib/docker/overlay2/.../work"
    }
  },
  "RootFS": {
    "Type": "layers",
    "Layers": [
      "sha256:layer1...",
      "sha256:layer2...",
      "sha256:layer3..."
    ]
  },
  "Metadata": {
    "LastTagTime": "2023-01-01T00:00:00.000000000Z"
  },
  "Manifests": [
    {
      "Descriptor": {
        "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
        "digest": "sha256:...",
        "size": 1234,
        "platform": {
          "architecture": "amd64",
          "os": "linux"
        }
      },
      "Available": true
    }
  ]
}

// API Handler
func (ir *imageRouter) getImagesByName(ctx context.Context, w http.ResponseWriter, r *http.Request) error {
    manifests := httputils.BoolValue(r, "manifests")
    
    var platform *ocispec.Platform
    if r.Form.Get("platform") != "" {
        platform, err = httputils.DecodePlatform(r.Form.Get("platform"))
    }
    
    imageInspect, err := ir.backend.ImageInspect(ctx, vars["name"], backend.ImageInspectOpts{
        Manifests: manifests,
        Platform:  platform,
    })
    
    return httputils.WriteJSON(w, http.StatusOK, imageInspect)
}

// Backend Implementation
func (i *ImageService) ImageInspect(ctx context.Context, refOrID string, opts backend.ImageInspectOpts) (*imagetypes.InspectResponse, error) {
    // 1. 解析镜像引用
    img, err := i.GetImage(ctx, refOrID, opts.Platform)
    
    // 2. 读取镜像配置
    config, err := i.getImageConfig(img.ID)
    
    // 3. 读取 GraphDriver 信息
    graphDriver := i.getGraphDriverData(img.ID)
    
    // 4. 读取 RootFS 信息
    rootFS := i.getRootFS(img.ID)
    
    // 5. 读取 Manifests（如果需要）
    var manifests []imagetypes.ManifestSummary
    if opts.Manifests {
        manifests = i.getManifests(img.ID)
    }
    
    return &imagetypes.InspectResponse{
        Id:          img.ID.String(),
        RepoTags:    i.getRepoTags(img.ID),
        RepoDigests: i.getRepoDigests(img.ID),
        Config:      config,
        Architecture: img.Platform.Architecture,
        Os:          img.Platform.OS,
        Size:        i.calculateSize(img.ID),
        GraphDriver: graphDriver,
        RootFS:      rootFS,
        Manifests:   manifests,
    }, nil
}

{
  "username": "user",
  "password": "pass",
  "email": "user@example.com",
  "serveraddress": "registry.example.com"
}

{"status":"Pulling from library/nginx","id":"latest"}
{"status":"Pulling fs layer","progressDetail":{},"id":"a2abf6c4d29d"}
{"status":"Downloading","progressDetail":{"current":1024,"total":27092228},"progress":"[>                  ]  1.024kB/27.09MB","id":"a2abf6c4d29d"}
{"status":"Download complete","progressDetail":{},"id":"a2abf6c4d29d"}
{"status":"Extracting","progressDetail":{"current":1024,"total":27092228},"progress":"[>                  ]  1.024kB/27.09MB","id":"a2abf6c4d29d"}
{"status":"Pull complete","progressDetail":{},"id":"a2abf6c4d29d"}
{"status":"Digest: sha256:abc123..."}
{"status":"Status: Downloaded newer image for nginx:latest"}

// API Handler
func (ir *imageRouter) postImagesCreate(ctx context.Context, w http.ResponseWriter, r *http.Request) error {
    image := r.Form.Get("fromImage")
    repo := r.Form.Get("repo")
    tag := r.Form.Get("tag")
    
    // 获取认证信息
    authConfig, err := registry.DecodeAuth(r.Header.Get("X-Registry-Auth"))
    
    // 解析平台
    var platform *ocispec.Platform
    if r.Form.Get("platform") != "" {
        platform, err = httputils.DecodePlatform(r.Form.Get("platform"))
    }
    
    output := ioutils.NewWriteFlusher(w)
    defer output.Close()
    
    // 调用后端拉取镜像
    if err := ir.backend.PullImage(ctx, image, tag, platform, authConfig, output); err != nil {
        output.Write(streamformatter.FormatError(err))
    }
    
    return nil
}

// Backend Implementation (daemon/images/image_pull.go)
func (i *ImageService) PullImage(ctx context.Context, imageName string, tag string, platform *ocispec.Platform,
                                   authConfig *registry.AuthConfig, outStream io.Writer) error {
    // 1. 解析镜像引用
    ref, err := reference.ParseNormalizedNamed(imageName)
    if tag != "" {
        ref, err = reference.WithTag(ref, tag)
    }
    
    // 2. 获取 registry 会话
    repoInfo, err := i.registryService.ResolveRepository(ref)
    session, err := i.registryService.NewSession(ctx, repoInfo, authConfig)
    
    // 3. 拉取 manifest
    progress.Message(outStream, "", fmt.Sprintf("Pulling from %s", reference.FamiliarName(ref)))
    
    manifest, err := session.GetManifest(ctx, ref)
    
    // 4. 处理 Manifest List（多平台）
    if manifestList, ok := manifest.(manifestlist.ManifestList); ok {
        manifest = i.selectPlatform(manifestList, platform)
    }
    
    // 5. 下载镜像层
    layers := manifest.References()
    for _, layer := range layers {
        progress.Update(outStream, layer.Digest.String(), "Pulling fs layer")
        
        // 检查本地是否已存在
        if i.layerStore.Exists(layer.Digest) {
            progress.Update(outStream, layer.Digest.String(), "Already exists")
            continue
        }
        
        // 下载层
        reader, err := session.DownloadLayer(ctx, layer.Digest)
        
        // 提取并注册层
        _, err = i.layerStore.Register(reader, layer.Digest)
        progress.Update(outStream, layer.Digest.String(), "Pull complete")
    }
    
    // 6. 创建镜像
    config := manifest.Config()
    imageID, err := i.imageStore.Create(config, layers)
    
    // 7. 添加标签
    i.referenceStore.AddTag(ref, imageID)
    
    progress.Message(outStream, "", fmt.Sprintf("Digest: %s", manifest.Descriptor().Digest))
    progress.Message(outStream, "", fmt.Sprintf("Status: Downloaded newer image for %s", reference.FamiliarString(ref)))
    
    return nil
}

{"status":"The push refers to repository [registry.example.com/nginx]"}
{"status":"Preparing","progressDetail":{},"id":"a2abf6c4d29d"}
{"status":"Pushing","progressDetail":{"current":1024,"total":27092228},"progress":"[>                  ]  1.024kB/27.09MB","id":"a2abf6c4d29d"}
{"status":"Pushed","progressDetail":{},"id":"a2abf6c4d29d"}
{"status":"latest: digest: sha256:abc123... size: 1234"}

// API Handler
func (ir *imageRouter) postImagesPush(ctx context.Context, w http.ResponseWriter, r *http.Request) error {
    ref, err := httputils.RepoTagReference(vars["name"], r.Form.Get("tag"))
    
    authConfig, err := registry.DecodeAuth(r.Header.Get("X-Registry-Auth"))
    
    var platform *ocispec.Platform
    if r.Form.Get("platform") != "" {
        platform, err = httputils.DecodePlatform(r.Form.Get("platform"))
    }
    
    output := ioutils.NewWriteFlusher(w)
    defer output.Close()
    
    pushOptions := &backend.PushOptions{
        AuthConfig: authConfig,
        Output:     output,
    }
    if platform != nil {
        pushOptions.Platforms = append(pushOptions.Platforms, *platform)
    }
    
    if err := ir.backend.PushImage(ctx, ref, pushOptions); err != nil {
        output.Write(streamformatter.FormatError(err))
    }
    
    return nil
}

// Backend Implementation
func (i *ImageService) PushImage(ctx context.Context, ref reference.Named, opts *backend.PushOptions) error {
    // 1. 获取镜像
    img, err := i.GetImage(ctx, ref.String(), nil)
    
    // 2. 获取 registry 会话
    repoInfo, err := i.registryService.ResolveRepository(ref)
    session, err := i.registryService.NewSession(ctx, repoInfo, opts.AuthConfig)
    
    // 3. 上传镜像层
    layers := i.getImageLayers(img.ID)
    for _, layer := range layers {
        progress.Update(opts.Output, layer.String(), "Preparing")
        
        // 检查远程是否已存在
        exists, err := session.LayerExists(ctx, layer)
        if exists {
            progress.Update(opts.Output, layer.String(), "Layer already exists")
            continue
        }
        
        // 上传层
        reader, err := i.layerStore.GetReader(layer)
        progress.Update(opts.Output, layer.String(), "Pushing")
        
        err = session.UploadLayer(ctx, layer, reader)
        progress.Update(opts.Output, layer.String(), "Pushed")
    }
    
    // 4. 上传配置
    configBlob, err := i.getImageConfig(img.ID)
    err = session.UploadBlob(ctx, img.ConfigDigest, bytes.NewReader(configBlob))
    
    // 5. 上传 manifest
    manifest := i.buildManifest(img)
    digest, err := session.PutManifest(ctx, ref, manifest)
    
    progress.Message(opts.Output, "", fmt.Sprintf("%s: digest: %s size: %d",
        reference.FamiliarString(ref), digest, len(manifest)))
    
    return nil
}

[
  {
    "Untagged": "nginx:latest"
  },
  {
    "Deleted": "sha256:abc123def456..."
  },
  {
    "Deleted": "sha256:layer1..."
  },
  {
    "Deleted": "sha256:layer2..."
  }
]

// API Handler
func (ir *imageRouter) deleteImages(ctx context.Context, w http.ResponseWriter, r *http.Request) error {
    name := vars["name"]
    
    force := httputils.BoolValue(r, "force")
    prune := !httputils.BoolValue(r, "noprune")
    
    list, err := ir.backend.ImageDelete(ctx, name, force, prune)
    
    return httputils.WriteJSON(w, http.StatusOK, list)
}

// Backend Implementation
func (i *ImageService) ImageDelete(ctx context.Context, imageRef string, force, prune bool) ([]imagetypes.DeleteResponse, error) {
    var records []imagetypes.DeleteResponse
    
    // 1. 解析镜像引用
    img, err := i.GetImage(ctx, imageRef, nil)
    
    // 2. 检查是否被容器使用
    containers := i.daemon.ContainersUsingImage(img.ID)
    if len(containers) > 0 && !force {
        return nil, errdefs.Conflict(fmt.Errorf("image is being used by %d containers", len(containers)))
    }
    
    // 3. 删除标签
    tags := i.referenceStore.References(img.ID)
    for _, tag := range tags {
        i.referenceStore.Delete(tag)
        records = append(records, imagetypes.DeleteResponse{
            Untagged: reference.FamiliarString(tag),
        })
    }
    
    // 4. 删除镜像（如果没有其他引用）
    if i.referenceStore.ReferenceCount(img.ID) == 0 {
        i.imageStore.Delete(img.ID)
        records = append(records, imagetypes.DeleteResponse{
            Deleted: img.ID.String(),
        })
        
        // 5. 删除镜像层（如果 prune=true）
        if prune {
            layers := i.getImageLayers(img.ID)
            for _, layer := range layers {
                if i.layerStore.ReferenceCount(layer) == 0 {
                    i.layerStore.Delete(layer)
                    records = append(records, imagetypes.DeleteResponse{
                        Deleted: layer.String(),
                    })
                }
            }
        }
    }
    
    return records, nil
}