Image Digest: The Immutable Image Identifier
An image digest is a unique fingerprint for a container image, guaranteeing you get the exact version you expect. Use it in production to pin an image, preventing unexpected updates from mutable tags like :latest. The footgun is assuming a tag is immutable.
Why it exists
Container image tags like ubuntu:latest or my-app:v1.2 are mutable pointers, not fixed versions. This creates a problem for reproducible builds and secure deployments. If a tag is updated, you might accidentally pull a new, untested, or even malicious version of an image.
The mental model
An image digest is the image's true name. While a tag is like a friendly, changeable nickname (latest), the digest is its permanent, unique identifier. It's a SHA256 hash of the image's manifest file. If even one bit changes in the image configuration or any of its layers, the manifest changes, and a new, different digest is generated. This guarantees immutability.
How it works
When you push an image, the registry calculates a digest. This digest is a hash of the image manifest, a JSON file that lists all configuration details and the content-addressable hashes of the image's layers. To pull an image by digest, you use the format repository@sha256:hash_value. The client can then verify that the manifest it downloads has a hash matching the one requested, ensuring its integrity.
When to use it
Always use digests for production deployments in systems like Kubernetes, Nomad, or Docker Swarm. This ensures that every pod or container runs the exact same, tested version of the code. It's also crucial for security scanning and auditing, as a digest points to an auditable, unchanging artifact.
When not to use it
For local development, using human-readable tags is often more convenient for quick iteration. Tags are also fine for pointing to the "latest stable" build in a CI/CD pipeline, as long as the final artifact deployed to production is referenced by its digest.
One canonical example
Instead of using image: nginx:1.21 in a Kubernetes manifest, you would find the digest for that tag (e.g., using docker inspect nginx:1.21). Then, you use the immutable reference in your deployment YAML: image: nginx@sha256:ea335eea17321a9ead83314915201602a3a332e73e0a049c63e3d2b635451999. This guarantees you are always running that specific version of Nginx, even if the 1.21 tag is later updated.
Interview question
Why is using an image digest crucial for production deployments, especially compared to using a mutable tag?
- a.Digests encrypt the image content, enhancing security during transmission.
- b.Digests guarantee that the exact, tested version of an image is deployed, preventing unintended updates.Correct
- c.Digests result in smaller image sizes and faster deployment times due to optimized hashing algorithms.
- d.Digests automatically pull the most recent and secure version of an image available in the registry.
Why? this is the answer
Digests provide an immutable reference, ensuring that the specific, tested version of an image is consistently deployed, which is vital for reproducibility and stability in production. Option D is incorrect because digests prevent automatic updates; they pin an image to a specific, unchanging version, which is the opposite of automatically pulling the 'most recent' version.
Just read this? Test yourself on what you have been reading.
Read the original → github.com
Put your scrolling time to good use
Learn one idea, try a quiz and save useful cards for revision. Tezvyn makes it easy to learn and stay current in your tech field, a few minutes at a time.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.
We are hiring for this. Open roles that interview on containers — each one lists the topics its interview covers.
See open roles