Unclear behaviour for `save`/`load` when using SHA (tag or not)

提供された Bash スクリプトを使って動作を再現することから始め、tag と SHA の参照を使う docker pull、docker save、docker load、およびその後の docker run コマンドに重点を置きます。ソースファイルやテストは指定されていないため、Docker CLI によるイメージ参照と save/load メタデータの処理を追跡してください。tag と SHA で指定されたイメージが save と load の後も実行可能であれば完了です。

Description

I will often save my Docker images in a gzipped tar file, in order to load them in a different environment.
Then recently I added checksums along with my tags, in order to pin my versions, while having a version manager update to the latest SHA for the given tag.
This combination is causing issues though.

Actually, using the SHA alone causes this not to work in the same way as using the combination.
AFAICT only the tag alone works.

Reproduce

I have a simple script to reproduce this:

#!/usr/bin/env bash

set -Eeuo pipefail

IMAGE="${1:-docker.io/library/alpine:3.21.3@sha256:2436f2b3b7d2537f4c5b622d7a820f00aaea1b6bd14c898142472947d5f02abe}"

# Pull image
docker pull "$IMAGE"
# Ensure that test runs with pulled image
docker run --pull=never --rm "$IMAGE" echo "If you see this it works!"
# Save pulled image
TAR="$(docker save "$IMAGE" | gzip | base64)"
# Remove local image
docker inspect "$IMAGE" --format='{{.Id}}' | xargs -r docker rmi
# Load saved image to local
echo "$TAR" | base64 --decode | docker load
# See that test fails with saved/loaded image
docker run --pull=never --rm "$IMAGE" echo "If you see this it also works!"

Expected behavior

I expected docker pull to include a reference using the provided tag, even though it is actually pulling via the SHA.

docker version

Client: Docker Engine - Community
 Version:           28.0.1
 API version:       1.48
 Go version:        go1.23.6
 Git commit:        068a01e
 Built:             Wed Feb 26 10:41:16 2025
 OS/Arch:           linux/amd64
 Context:           default

Server: Docker Engine - Community
 Engine:
  Version:          28.0.1
  API version:      1.48 (minimum version 1.24)
  Go version:       go1.23.6
  Git commit:       bbd0a17
  Built:            Wed Feb 26 10:41:16 2025
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.7.25
  GitCommit:        bcc810d6b9066471b0b6fa75f557a15a1cbf31bb
 runc:
  Version:          1.2.4
  GitCommit:        v1.2.4-0-g6c52b3f
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

docker info

Client: Docker Engine - Community
 Version:    28.0.1
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.21.1
    Path:     /usr/libexec/docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v2.33.1
    Path:     /usr/libexec/docker/cli-plugins/docker-compose

Server:
 Containers: 1
  Running: 1
  Paused: 0
  Stopped: 0
 Images: 174
 Server Version: 28.0.1
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Using metacopy: false
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: systemd
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: bcc810d6b9066471b0b6fa75f557a15a1cbf31bb
 runc version: v1.2.4-0-g6c52b3f
 init version: de40ad0
 Security Options:
  apparmor
  seccomp
   Profile: builtin
  cgroupns
 Kernel Version: 6.1.0-28-amd64
 Operating System: Debian GNU/Linux 12 (bookworm)
 OSType: linux
 Architecture: x86_64
 CPUs: 16
 Total Memory: 31.13GiB
 Name: <company PC>
 ID: <>
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Experimental: false
 Insecure Registries:
  ::1/128
  127.0.0.0/8
 Registry Mirrors:
  <company mirror>
 Live Restore Enabled: false

Additional Info

I tried both with and without the company mirror for Docker Hub to no avail.