Why this works without ever pulling the image

The Docker Registry HTTP API v2 is designed around content-addressable manifests — a small JSON document describing an image's layers, platform, and configuration, addressable by its own SHA-256 digest — that can be fetched independently of downloading any actual layer data. Everything this tool shows (platforms, layer count, total size, entrypoint, environment variables, exposed ports) comes from reading that manifest and its associated config blob, not from pulling and unpacking the image itself. That's exactly how `docker manifest inspect` and `docker inspect` on a pulled image work too — this tool does the manifest half of that without needing local Docker or actually pulling anything.

Why a multi-arch tag needs a different view than a single manifest

Modern image tags are frequently manifest lists (or OCI indexes) — one tag that actually points to several platform-specific manifests (linux/amd64, linux/arm64, and so on), letting `docker pull` transparently grab the right one for whatever machine is running it. Inspecting a reference like that means listing every platform variant with its own digest rather than assuming there's a single image behind the tag, which is why this tool branches into two different views depending on what the reference actually resolves to: a platform list for a manifest list/index, or the full layer/config breakdown for a single concrete image manifest.

Why only anonymous-pullable images work here

Docker Hub and most other registries allow pulling public images without authentication, obtaining a short-lived anonymous access token through the registry's standard auth flow — the same thing `docker pull` does behind the scenes for a public image with no `docker login` performed. This tool reproduces exactly that anonymous flow and nothing more; it has no mechanism to accept or use credentials, which means private images and registries requiring authentication for pulls will simply fail here, by design, rather than this tool ever asking for or handling a credential it has no safe way to store.