sxsphinxstack

Skills / Starter / Check a container image tag

Starter Code skill

Check a container image tag

Check a container image tag by resolving its digest, registry, platform manifest, provenance, signature, and deployment use.

When to use

  • Use during release, incident, rollback, or environment comparison.
  • Do not pull or execute an untrusted image on a privileged host.

Preconditions

  • Record registry, repository, tag, platform, credentials scope, time, and expected digest.

Procedure

  1. Resolve the tag from the authoritative registry without execution.
  2. Record index and platform-specific digests plus media types.
  3. Inspect creation metadata, source revision, SBOM, provenance, and signatures.
  4. Compare deployment references and node-cached digests.
  5. Detect tag mutation, platform divergence, registry mirror, and stale pull policy.
  6. Recommend digest pinning or correction with rollback evidence.

Failure plan

  • Quarantine when provenance, signature, or expected digest cannot be established.

Worked example

The same tag points to a new arm64 manifest while x86 remains old, explaining architecture-specific behavior.

Related skills

  • Add an application health check — Add bounded liveness, readiness, and startup checks that reflect an application's ability to serve.
  • Check a database index — Check whether a database index supports a real query using definition, selectivity, plan, statistics, write cost, and production-safe evidence.
  • Verify a backup restore — Prove that backups can restore a usable, internally consistent, and operationally recoverable system under time pressure.