Instead of sending DB IDs, send "internal IDs" which are DB IDs hashed. This way, we can still calculate the ancestors without hitting the DB further, but without leaking the size of the images table

endpoints/api/image.py

@@ -4,7 +4,7 @@ from collections import defaultdict
 
 from app import storage as store
 from endpoints.api import (resource, nickname, require_repo_read, RepositoryParamResource,
-                           format_date, NotFound)
+                           format_date, NotFound, calculate_internal_id)
 from data import model
 from util.cache import cache_control_flask_restful
 
@@ -15,16 +15,31 @@ def image_view(image):
     extended_props = image.storage
 
   command = extended_props.command
+
+  def internal_id(aid):
+    if aid == '':
+      return ''
+
+    return calculate_internal_id(aid)
+
+  # Calculate the ancestors string, with the DBID's replaced with the
+  # hashed 'internal' IDs.
+  ancestors = [internal_id(a) for a in image.ancestors.split('/')]
+  ancestors_string = '/'.join(ancestors)
+
   return {
     'id': image.docker_image_id,
     'created': format_date(extended_props.created),
     'comment': extended_props.comment,
     'command': json.loads(command) if command else None,
-    'ancestors': image.ancestors,
-    'dbid': image.id,
     'size': extended_props.image_size,
     'locations': list(image.storage.locations),
     'uploading': image.storage.uploading,
+
+    'ancestors': ancestors_string,
+
+    'internal_id': calculate_internal_id(image.id),
+    'sort_index': len(image.ancestors)
   }