Add an optional check to docker-image and podman-image that flags a local image as outdated when it no longer matches the image currently published under the same repository tag in the remote registry. Image age alone does not reveal that a newer build was pushed upstream under an unchanged tag (e.g. nginx:1.27); this surfaces images that should be re-pulled or rebuilt. Opt-in via a new flag with configurable WARN/CRIT, applying to both plugins (rootless via --user) and consistent with the existing age check and filters.
The simplest implementation compares the local image digest against the registry via skopeo inspect docker://<repo:tag>, which handles registry auth, manifest resolution and multi-arch; skopeo then becomes an optional requirement that degrades to UNKNOWN when missing.
Without skopeo, the comparison goes straight against the Registry HTTP API v2:
- Local side: the image config digest from
<engine> image inspect (.Id, with .RepoDigests / .Architecture).
- Registry side:
GET https://<registry>/v2/<name>/manifests/<tag> with Accept: application/vnd.docker.distribution.manifest.v2+json. On 401, run the Registry v2 bearer-token flow: parse WWW-Authenticate: Bearer realm=…,service=…,scope=…, fetch a token from the realm, then retry.
- Multi-arch: if the response is a manifest list (
manifests key), pick the entry whose platform.architecture matches the host, fetch that manifest and read its config.digest.
- Equal digests → up to date, otherwise outdated.
- Name normalisation: no registry defaults to
registry-1.docker.io, official images get a library/ prefix, and a missing tag means latest.
Caveats: needs network access to the registry (private registries need credentials, plus an --insecure option for plain-HTTP registries); public registries such as Docker Hub enforce pull-rate limits, so keep this a daily check.
Add an optional check to
docker-imageandpodman-imagethat flags a local image as outdated when it no longer matches the image currently published under the same repository tag in the remote registry. Image age alone does not reveal that a newer build was pushed upstream under an unchanged tag (e.g.nginx:1.27); this surfaces images that should be re-pulled or rebuilt. Opt-in via a new flag with configurable WARN/CRIT, applying to both plugins (rootless via--user) and consistent with the existing age check and filters.The simplest implementation compares the local image digest against the registry via
skopeo inspect docker://<repo:tag>, which handles registry auth, manifest resolution and multi-arch;skopeothen becomes an optional requirement that degrades to UNKNOWN when missing.Without skopeo, the comparison goes straight against the Registry HTTP API v2:
<engine> image inspect(.Id, with.RepoDigests/.Architecture).GET https://<registry>/v2/<name>/manifests/<tag>withAccept: application/vnd.docker.distribution.manifest.v2+json. On401, run the Registry v2 bearer-token flow: parseWWW-Authenticate: Bearer realm=…,service=…,scope=…, fetch a token from the realm, then retry.manifestskey), pick the entry whoseplatform.architecturematches the host, fetch that manifest and read itsconfig.digest.registry-1.docker.io, official images get alibrary/prefix, and a missing tag meanslatest.Caveats: needs network access to the registry (private registries need credentials, plus an
--insecureoption for plain-HTTP registries); public registries such as Docker Hub enforce pull-rate limits, so keep this a daily check.