That's because the parent comment is completely wrong. Images have a reference (e.g. "ubuntu:20.04"), they have an ID inside docker (random string), and they h

That's because the parent comment is completely wrong. Images have a reference (e.g. "ubuntu:20.04"), they have an ID inside docker (random string), and they have a digest. All image data is stored by digest. Even when you fetch an image reference it is looking up the digest of that reference and fetching that digest and that digest is verified. An image manifest contains the digests of the image config and the digest of all the layers, the image config also stores the digest of all the layers. This is how all the data is traversed from the registry.