<p>Yes, you can use the <em>repository digest</em> for this. Note that while this is a hash of the container, it's a hash specific to the repository, and is <strong>NOT</strong> the image id, which is a separate sha256 hash.</p>

<p>Once you push or pull a docker container to/from a registry, it acquires some repository metadata, including the repository digest for that container. You can see that digest by running <code>docker inspect &lt;container-tag-or-id&gt;</code> and looking for the <code>RepoDigests</code> section of the json (or just pipe that command into <code>jq '.[].RepoDigests'</code> if you have it installed.</p>

<p>Now you can compare that with the docker pullable of the kubernetes pod you want to check by running this command:</p>

<p><code>kubectl get pod &lt;POD&gt; -o jsonpath='{.status.containerStatuses[*].imageID}'</code></p>

<p>If the hashes of both of those values match, then you can be sure they are running the same container.</p>

CC BY-SA 4.0
2019-12-12T04:14:24.043Z
2019-12-12T04:14:24.043Z
cheeseandcereal
<p><strong>Situation</strong></p>

<p>I have a docker image on a Linux box. I push it onto a docker registry (AWS ECR).</p>

<p>Then, I use the image pushed onto that docker registry in a K8s pod.</p>

<p><strong>Question</strong></p>

<p>How do I know the docker image used for the K8s pod is the same as the one on the Linux box? Note that the tag is irrelevant. I set it to different things all the time.</p>

CC BY-SA 4.0
2019-12-11T15:59:25.353Z
What exactly are you concerned about and why aren't you using tags for this?
Matthew
CC BY-SA 4.0
2019-12-11T16:53:37.637Z
I guess the correct docker way of doing this is (1) push the image to a centralized registry (2) use tags to differentiate the platform/version for the same image. You're doing the first (1) right, but the second one you're doing wrong. If you tag it correctly, if you inspect your pod, you will be able to see the same image/tag, that came from the same registry (therefore it's the same as the image from your Linux box).
Emerson Cardoso
<docker><kubernetes>
Is it reliable to use Docker's hash as a mean to determine image's version between different platform
Tran Triet
# Is it reliable to use Docker's hash as a mean to determine image's version between different platform

(Asked by: username_0 on 2019-12-11)

**Situation**

I have a docker image on a Linux box. I push it onto a docker registry (AWS ECR).

Then, I use the image pushed onto that docker registry in a K8s pod.

**Question**

How do I know the docker image used for the K8s pod is the same as the one on the Linux box? Note that the tag is irrelevant. I set it to different things all the time.

**Tags:** docker, kubernetes

> **Comments:**
> **username_1**: What exactly are you concerned about and why aren't you using tags for this?  
> **username_2**: I guess the correct docker way of doing this is (1) push the image to a centralized registry (2) use tags to differentiate the platform/version for the same image. You're doing the first (1) right, but the second one you're doing wrong. If you tag it correctly, if you inspect your pod, you will be able to see the same image/tag, that came from the same registry (therefore it's the same as the image from your Linux box).  

---

## 1 answers

### Answer by username_3 on 2019-12-12. Score: 3

Yes, you can use the *repository digest* for this. Note that while this is a hash of the container, it's a hash specific to the repository, and is **NOT** the image id, which is a separate sha256 hash.

Once you push or pull a docker container to/from a registry, it acquires some repository metadata, including the repository digest for that container. You can see that digest by running `docker inspect`  and looking for the `RepoDigests` section of the json (or just pipe that command into `jq '.[].RepoDigests'` if you have it installed.

Now you can compare that with the docker pullable of the kubernetes pod you want to check by running this command:

`kubectl get pod  -o jsonpath='{.status.containerStatuses[*].imageID}'`

If the hashes of both of those values match, then you can be sure they are running the same container.


---

