Comparison
Image digestvsImage tag
Image digest
the deployment names a sha256 hash instead of a version, and there is exactly one set of bytes that could ever satisfy it.
The content hash of an image manifest, and therefore an immutable identifier for exactly those bytes. It is what makes a rollout reproducible and what signing and admission policies actually attach to, since a signature over a mutable tag would prove nothing. The cost is legibility — nobody can read a rollout history of hashes — which is why pipelines usually keep the tag for people and the digest for machines.
Full entry →Image tag
two nodes ran what the manifest called the same version and behaved differently, because someone had pushed over the tag.
A human-readable, mutable pointer to an image — `v2.3.1`, `main`, `latest`. Because it can be repointed at any time, a tag is a name rather than an identity: pulling it twice can legitimately give you two different images. Almost every 'but it worked in staging' mystery in a container platform is a tag that moved between the two deployments.
Full entry →