Using container image tags together with digests

user_2428569 0
Viewed 283

Problem

It is well-known that digests are immutable while tags are mutable. And referring to digests is preferable in a number of cases where you need to guarantee that the same exact image should be used during the lifetime of the service. It is considered the best practice for production environments (see this and this).

The problem with the digests that while being immutable and useful they are not human-readable. And all the examples use either digest or tags. But practice shows that you can use both. It is just that tag is omitted.

For instance:

docker run --rm k8s.gcr.io/pause-amd64:3.1@sha256:59eec8837a4d942cc19a52b8c09ea75121acc38114a2c68b98983ce9356b8610
kubectl create deployment pause --image k8s.gcr.io/pause-amd64:3.1@sha256:59eec8837a4d942cc19a52b8c09ea75121acc38114a2c68b98983ce9356b8610

Question

is it safe to use the <image_path>:<tag>@sha256:<digest> pattern?

Edit

Seems like it's absolutely legit.

docker-image docker
1 Answers

Yes, the tag is ignored when the digest is present.

You can even make up a tag and it will still pull the image by digest:

docker image pull k8s.gcr.io/pause-amd64:some-made-up-tag@sha256:59eec8837a4d942cc19a52b8c09ea75121acc38114a2c68b98983ce9356b8610

sha256:59eec8837a4d942cc19a52b8c09ea75121acc38114a2c68b98983ce9356b8610: Pulling from pause-amd64
Digest: sha256:59eec8837a4d942cc19a52b8c09ea75121acc38114a2c68b98983ce9356b8610
Status: Image is up to date for k8s.gcr.io/pause-amd64@sha256:59eec8837a4d942cc19a52b8c09ea75121acc38114a2c68b98983ce9356b8610
user_4499580
Related