Image Digest: The Immutable Image Identifier
An image digest is a unique fingerprint for a container image, guaranteeing you get the exact version you expect. Use it in production to pin an image, preventing unexpected updates from mutable tags like `:latest`. The footgun is assuming a tag is immutable.
WHY IT EXISTS: Container image tags like ubuntu:latest or my-app:v1.2 are mutable pointers, not fixed versions. This creates a problem for reproducible builds and secure deployments. If a tag is updated, you might accidentally pull a new, untested, or even malicious version of an image.
THE MENTAL MODEL: An image digest is the image's true name. While a tag is like a friendly, changeable nickname (latest), the digest is its permanent, unique identifier. It's a SHA256 hash of the image's manifest file. If even one bit changes in the image configuration or any of its layers, the manifest changes, and a new, different digest is generated. This guarantees immutability.
HOW IT WORKS: When you push an image, the registry calculates a digest. This digest is a hash of the image manifest, a JSON file that lists all configuration details and the content-addressable hashes of the image's layers. To pull an image by digest, you use the format repository@sha256:hash_value. The client can then verify that the manifest it downloads has a hash matching the one requested, ensuring its integrity.
WHEN TO USE IT: Always use digests for production deployments in systems like Kubernetes, Nomad, or Docker Swarm. This ensures that every pod or container runs the exact same, tested version of the code. It's also crucial for security scanning and auditing, as a digest points to an auditable, unchanging artifact.
WHEN NOT TO USE IT: For local development, using human-readable tags is often more convenient for quick iteration. Tags are also fine for pointing to the "latest stable" build in a CI/CD pipeline, as long as the final artifact deployed to production is referenced by its digest.
ONE CANONICAL EXAMPLE: Instead of using image: nginx:1.21 in a Kubernetes manifest, you would find the digest for that tag (e.g., using docker inspect nginx:1.21). Then, you use the immutable reference in your deployment YAML: image: nginx@sha256:ea335eea17321a9ead83314915201602a3a332e73e0a049c63e3d2b635451999. This guarantees you are always running that specific version of Nginx, even if the 1.21 tag is later updated.
Read the original → github.com
Get five bites like this every day.
Tezvyn delivers a daily feed of 60-second tech bites with quizzes to lock in what you learn.