Read the tag's digest with docker buildx imagetools inspect, store it, and compare it the next time you pull. If the digest differs, the tag now points at different content. Then scan both versions and diff the findings or SBOMs before you accept the new one.
Step 1: read the digest
Docker's reference for the command shows the usage as docker buildx imagetools inspect followed by the image name. The default output includes the manifest list digest, and each platform entry carries its own digest after an at sign in its name, along with a platform value such as linux/amd64.
docker buildx imagetools inspect alpine:3
The top digest identifies the whole multi-platform list. The per-platform digests identify the image your machine will actually run. Both matter, and the next section says which to store.
Step 2: choose what to record
If you deploy to one architecture, record the digest of that platform's image. If you want one reference that works everywhere, record the manifest list digest. Either is fine as long as you are consistent and you pin it in your build files.
For raw output, the command supports a raw flag and a format option that takes a Go template, so you can print only the digest in scripts.
Step 3: compare on a schedule
A small script can pull the tag's current digest and compare it with the one you recorded. A change is a prompt to look, not proof of a problem. Expected causes include a rebuilt base layer or a new patch release.
| Digest result | Meaning | Action |
|---|---|---|
| Same as recorded | Tag unchanged | Nothing to do |
| Different, expected release | Tag moved forward | Scan, test, update the pin |
| Different, no announced release | Something unexplained | Hold the update, check the publisher's source and notes |
Step 4: see what is different
Once you have two digests, scan both and compare findings. If you also generate an SBOM for each, a diff of the package lists shows which packages were added, removed or changed. That tells you whether the move was a patch rollup or something bigger.
Step 5: update by pull request
Change the pinned digest in one reviewed pull request that includes the scan result. Reviewers then see the change and the evidence together.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how an inventory lists components, which is the view you compare between two digests.
Quick check
Is the manifest list digest the same as the digest of my platform image?
No. The list digest covers all platforms. Each platform entry has its own digest after the at sign in its name.
Does a changed digest mean an attack?
No. Rebuilds for base updates and new releases change digests routinely. Treat it as a prompt to scan and review.
Safeguard dependency scanning and SBOM generation work on the image you pin, so you can compare two versions with evidence. Try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
