2

Situation

I have a docker image on a Linux box. I push it onto a docker registry (AWS ECR).

Then, I use the image pushed onto that docker registry in a K8s pod.

Question

How do I know the docker image used for the K8s pod is the same as the one on the Linux box? Note that the tag is irrelevant. I set it to different things all the time.

2
  • What exactly are you concerned about and why aren't you using tags for this? – Matthew Dec 11 '19 at 15:59
  • I guess the correct docker way of doing this is (1) push the image to a centralized registry (2) use tags to differentiate the platform/version for the same image. You're doing the first (1) right, but the second one you're doing wrong. If you tag it correctly, if you inspect your pod, you will be able to see the same image/tag, that came from the same registry (therefore it's the same as the image from your Linux box). – Emerson Cardoso Dec 11 '19 at 16:53
2

Yes, you can use the repository digest for this. Note that while this is a hash of the container, it's a hash specific to the repository, and is NOT the image id, which is a separate sha256 hash.

Once you push or pull a docker container to/from a registry, it acquires some repository metadata, including the repository digest for that container. You can see that digest by running docker inspect <container-tag-or-id> and looking for the RepoDigests section of the json (or just pipe that command into jq '.[].RepoDigests' if you have it installed.

Now you can compare that with the docker pullable of the kubernetes pod you want to check by running this command:

kubectl get pod <POD> -o jsonpath='{.status.containerStatuses[*].imageID}'

If the hashes of both of those values match, then you can be sure they are running the same container.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.