{pkgs, lib, imageName, imageDigest, sha256,
    registry ? "",
    os ? "linux",
    arch ? "amd64",
    finalImageTag ? "latest",
    name ? builtins.replaceStrings ["/" ":"] ["-" "-"] "docker-image-${imageName}-${finalImageTag}.tar",
    copyFlags ? []}:

let
    fixRegistry  = lib.removePrefix "https://" (lib.removePrefix "http://" registry);
in
pkgs.runCommand name {
     inherit imageName imageDigest;
     imageTag = finalImageTag;
     impureEnvVars = pkgs.stdenv.lib.fetchers.proxyImpureEnvVars;
     outputHashMode = "flat";
     outputHashAlgo = "sha256";
     outputHash = sha256;

     nativeBuildInputs = lib.singleton (pkgs.skopeo);
     SSL_CERT_FILE = "${pkgs.cacert.out}/etc/ssl/certs/ca-bundle.crt";

     sourceURL = "docker://${fixRegistry}${lib.optionalString (registry!="") "/"}${imageName}@${imageDigest}";
     destNameTag = "${imageName}:${finalImageTag}";
     cpFlags = copyFlags;
    } ''
     skopeo --override-os ${os} --override-arch ${arch} copy $cpFlags "$sourceURL" "docker-archive://$out:$destNameTag"
    ''