Situation
I have a docker image on a Linux box. I push it onto a docker registry (AWS ECR).
Then, I use the image pushed onto that docker registry in a K8s pod.
Question
How do I know the docker image used for the K8s pod is the same as the one on the Linux box? Note that the tag is irrelevant. I set it to different things all the time.
Yes, you can use the repository digest for this. Note that while this is a hash of the container, it's a hash specific to the repository, and is NOT the image id, which is a separate sha256 hash.
Once you push or pull a docker container to/from a registry, it acquires some repository metadata, including the repository digest for that container. You can see that digest by running docker inspect <container-tag-or-id> and looking for the RepoDigests section of the json (or just pipe that command into jq '.[].RepoDigests' if you have it installed.
Now you can compare that with the docker pullable of the kubernetes pod you want to check by running this command:
kubectl get pod <POD> -o jsonpath='{.status.containerStatuses[*].imageID}'
If the hashes of both of those values match, then you can be sure they are running the same container.
