podman images --filter reference=<repo> prints out matches from other repos

[dustymabe]

Issue Description

This is a continuation of a similar issue described in #25725 and "fixed" in containers/common#2413 (after library merge look at podman-container-tools/container-libs@74e3753). Note I put "fixed" in quotes here because the reproducer described in the original issue is exactly still reproducible today.

Here's the crux of the problem:

[bound] -bash-5.3$ podman pull --quiet quay.io/fedora/fedora:44                                     
113f8751d76ff94ef19b09a3523e617018b6924a3f5b5941e99ee5d897941aee                                    
[bound] -bash-5.3$ podman tag quay.io/fedora/fedora:44 localhost/fedora-local:latest                
[bound] -bash-5.3$ podman images --format '{{.Repository}} {{.Tag}}' --noheading --filter  reference='localhost/fedora-local'                                                                            
localhost/fedora-local latest 
quay.io/fedora/fedora 44                                                                            
[bound] -bash-5.3$

So we end up with two pieces of output when we were asking for information about only --filter reference='localhost/fedora-local'.

[bound] -bash-5.3$ podman images --format '{{.Id}}' --noheading --filter  reference='localhost/fedora-local'                                                                                             
113f8751d76ff94ef19b09a3523e617018b6924a3f5b5941e99ee5d897941aee                                                                                                                                         
113f8751d76ff94ef19b09a3523e617018b6924a3f5b5941e99ee5d897941aee

Steps to reproduce the issue

Steps to reproduce the issue

1. podman pull --quiet quay.io/fedora/fedora:44
2. podman tag quay.io/fedora/fedora:44 localhost/fedora-local:latest
3. podman images --format '{{.Repository}} {{.Tag}}' --noheading --filter reference='localhost/fedora-local'

Describe the results you received

Images from quay.io/fedora/fedora in the output

Describe the results you expected

Expected only images matching reference='localhost/fedora-local' to be output.

podman info output

<details>
[bound] -bash-5.3$ podman info
host:
  arch: amd64
  buildahVersion: 1.43.0
  cgroupControllers:
  - cpu
  - memory
  - pids
  cgroupManager: systemd
  cgroupVersion: v2
  conmon:
    package: conmon-2.2.1-2.fc44.x86_64
    path: /usr/bin/conmon
    version: 'conmon version 2.2.1, commit: '
  cpuUtilization:
    idlePercent: 90.74
    systemPercent: 4.91
    userPercent: 4.35
  cpus: 1
  databaseBackend: sqlite
  distribution:
    distribution: fedora
    variant: coreos
    version: "44"
  eventLogger: journald
  freeLocks: 2048
  hostname: kola-408f2c3a4a6ec0515bad
  idMappings:
    gidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 524288
      size: 65536
    uidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 524288
      size: 65536
  kernel: 6.19.12-300.fc44.x86_64
  linkmode: dynamic
  logDriver: journald
  memFree: 3063222272
  memTotal: 3825790976
  networkBackend: netavark
  networkBackendInfo:
    backend: netavark
    defaultNetwork: podman
    dns:
      package: aardvark-dns-1.17.0-3.fc44.x86_64
      path: /usr/libexec/podman/aardvark-dns
      version: aardvark-dns 1.17.0
    package: netavark-1.17.2-1.fc44.x86_64
    path: /usr/libexec/podman/netavark
    version: netavark 1.17.2
  ociRuntime:
    name: crun
    package: crun-1.27-1.fc44.x86_64
    path: /usr/bin/crun
    version: |-
      crun version 1.27
      commit: a718a92cc9a94955a5a550b6fdec1378c247ec50
      rundir: /run/user/1000/crun
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +LIBKRUN +WASM:wasmedge +YAJL
  os: linux
  pasta:
    executable: /usr/bin/pasta
    package: passt-0^20260120.g386b5f5-1.fc44.x86_64
    version: |
      pasta 0^20260120.g386b5f5-1.fc44.x86_64
      Copyright Red Hat
      GNU General Public License, version 2 or later
        <https://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
      This is free software: you are free to change and redistribute it.
      There is NO WARRANTY, to the extent permitted by law.
  remoteSocket:
    exists: true
    path: /run/user/1000/podman/podman.sock
  rootlessNetworkCmd: pasta
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: true
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: true
  serviceIsRemote: false
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: slirp4netns-1.3.1-4.fc44.x86_64
    version: |-
      slirp4netns version 1.3.1
      commit: e5e368c4f5db6ae75c2fce786e31eef9da6bf236
      libslirp: 4.9.1
      SLIRP_CONFIG_VERSION_MAX: 6
      libseccomp: 2.6.0
  swapFree: 0
  swapTotal: 0
  uptime: 0h 4m 8.00s
  variant: ""
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  - journald
  network:
  - bridge
  - macvlan
  - ipvlan
  volume:
  - local
registries:
  search:
  - registry.fedoraproject.org
  - registry.access.redhat.com
  - docker.io
store:
  configFile: /var/home/core/.config/containers/storage.conf
  containerStore:
    number: 0
    paused: 0
    running: 0
    stopped: 0
  graphDriverName: overlay
  graphOptions: {}
  graphRoot: /var/home/core/.local/share/containers/storage
  graphRootAllocated: 16574820352
  graphRootUsed: 2418155520
  graphStatus:
    Backing Filesystem: xfs
    Native Overlay Diff: "true"
    Supports d_type: "true"
    Supports shifting: "false"
    Supports volatile: "true"
    Using metacopy: "false"
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 1
  runRoot: /run/user/1000/containers
  transientStore: false
  volumePath: /var/home/core/.local/share/containers/storage/volumes
version:
  APIVersion: 5.8.1
  BuildOrigin: Fedora Project
  Built: 1773187200
  BuiltTime: Wed Mar 11 00:00:00 2026
  GitCommit: c6077f645788743258a1a749f8005b4fb3cbe533
  GoVersion: go1.26.0-X:nodwarf5
  Os: linux
  OsArch: linux/amd64
  Version: 5.8.1


</details>

Podman in a container

No

Privileged Or Rootless

Rootless

Upstream Latest Release

No

Additional environment details

[bound] -bash-5.3$ rpm -q podman                                                                    
podman-5.8.1-1.fc44.x86_64

Additional information

Additional information like issue happens only occasionally or issue happens with a particular architecture or on a particular setting

[Honny1]

This is expected behavior per the design in containers/common#2413. Name filtering only applies when the reference is fully qualified (includes a tag or digest). localhost/fedora-local is a bare repo name without a tag, so the filter matches the image but does not restrict which names are displayed. Using --filter reference='localhost/fedora-local:latest' will return only the matching entry.

[dustymabe]

Thanks for the reply @Honny1.

Is it expected that the reproducer in the description of #25725 is exactly reproducible today?

[core@cosa-devsh ~]$ mkdir build
[core@cosa-devsh ~]$ cd build/
[core@cosa-devsh build]$ echo "FROM fedora:41" > Containerfile
[core@cosa-devsh build]$ podman build -t example
Error: no context directory and no Containerfile specified
[core@cosa-devsh build]$ podman build -t example .
STEP 1/1: FROM fedora:41
Resolved "fedora" as an alias (/etc/containers/registries.conf.d/000-shortnames.conf)
Trying to pull registry.fedoraproject.org/fedora:41...
Getting image source signatures
Copying blob b2e5d4693765 done   | 
Copying config 432fb3cbc4 done   | 
Writing manifest to image destination
COMMIT example
--> 432fb3cbc49c
Successfully tagged localhost/example:latest
Successfully tagged registry.fedoraproject.org/fedora:41
432fb3cbc49c04402a3dbf71c18aab8e302fe31c9697762f9ec4718423ed70b4
[core@cosa-devsh build]$ podman images example
REPOSITORY                         TAG         IMAGE ID      CREATED       SIZE
localhost/example                  latest      432fb3cbc49c  4 months ago  167 MB
registry.fedoraproject.org/fedora  41          432fb3cbc49c  4 months ago  167 MB

I just don't understand why you would use podman images --filter reference='localhost/fedora-local:latest'. If you know the fully qualified name why not just use podman inspect localhost/fedora-local:latest?

[Honny1]

The reference filter operates on images, not on individual names. Since localhost/fedora-local (without a tag) doesn't unambiguously identify a single name, Podman finds the matching image and displays all its tags. Your example shows one image with two tags (localhost/fedora-local:latest and quay.io/fedora/fedora:44), and both are valid names for that same image.

If you need an exact lookup, podman inspect or --filter reference='localhost/fedora-local:latest' (with the tag) will give you a single result. For example, podman inspect shows it is indeed one image:

$ podman pull --quiet quay.io/fedora/fedora:44
722f849805f3cd4b446c5244ef4f82f60cdeeda37879e816fad9721c2f684546
$ podman tag quay.io/fedora/fedora:44 localhost/fedora-local:latest
$ podman inspect localhost/fedora-local
[
     {
          "Id": "722f849805f3cd4b446c5244ef4f82f60cdeeda37879e816fad9721c2f684546",
          ...
          "RepoTags": [
               "localhost/fedora-local:latest",
               "quay.io/fedora/fedora:44"
          ],
          ...
     }
]

Both localhost/fedora-local:latest and quay.io/fedora/fedora:44 are names for the same image (722f849805f3), so when filtering by a bare repo name, Podman correctly lists all of them.

[dustymabe]

Thank you for the explanation. I can't say I fully understand the rationale, but trust you that it's working as designed.

Can you (I'm not allowed since the conversation is locked) add a comment to #25725 to state that the specific problem documented in the description wasn't fixed by containers/common#2413 and is actually the intended behavior.

[Honny1]

Done.