Find Version Tag for Latest Docker Image

If you’ve ever used Docker, you’ve probably used the latest Docker image tag. This is bad. Do not do this! You will be in a situation where you need to find what version you were actually using. This is how you can find the version of that “latest” image you have running.

Every time you build a new image, use a new version for your image tags.
Every time you pull an image, use a specific image tag version.

This article describes why latest is bad.

For me, in this theoretical example.. An image I was using introduced breaking changes. This is fine, since they tagged the new releases as version 2. But, only if I was actually using a specific image version and not latest would this be okay. Latest is latest. So the latest that was version 1, now turned into version 2. And everything broke.

Now that you will never use latest again, you could still have a problem. All those docker containers you have running are using images with the :latest tag. How do you find what version latest was?

I hope you’re Lucky.. Trick #1

Check the labels on your image. If you’re lucky, the developer added a label to the image with the version. I’m using the utility jq below. It’s very helpful, be sure to install it.

$ docker images
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
traefik             latest              96c63a7d3e50        2 months ago        85.7MB

$ IMAGE_ID=96c63a7d3e50

$ docker image inspect --format '{{json .}}' "$IMAGE_ID" | jq -r '. | {Id: .Id, Digest: .Digest, RepoDigests: .RepoDigests, Labels: .Config.Labels}'

Output:

{
  "Id": "sha256:96c63a7d3e502fcbbd8937a2523368c22d0edd1788b8389af095f64038318834",
  "Digest": null,
  "RepoDigests": [
    "traefik@sha256:5ec34caf19d114f8f0ed76f9bc3dad6ba8cf6d13a1575c4294b59b77709def39"
  ],
  "Labels": {
    "org.opencontainers.image.description": "A modern reverse-proxy",
    "org.opencontainers.image.documentation": "https://docs.traefik.io",
    "org.opencontainers.image.title": "Traefik",
    "org.opencontainers.image.url": "https://traefik.io",
    "org.opencontainers.image.vendor": "Containous",
    "org.opencontainers.image.version": "v1.7.20"
  }
}

Bingo! That’s version 1.7.20 of Traefik!

Lucky Trick #2

Pull a bunch of images and hope the Image ID matches. Not much to this trick..

Lucky Trick #3

If your image is from Docker Hub, they have a new experimental tool you can use called “Docker Hub Tool“.

But what if you are unlucky? What if there’s a way to check all version tags of an image?

Find Version Tag for Latest Docker image

There’s a way to check all version tags on Docker Hub (for example), against the local docker image’s “Image ID”.

You can get every tag from a Docker Registry (like Docker Hub), then use every tag you found, to get the image ID information from the manifest of every image.

Docker Hub has some quirks compared to a proper Docker Registry, and the API isn’t well documented. But let’s focus on Docker Hub, since that’s a huge public image repository.

If you don’t want to do all of this manually, you can use my script (on GitHub). Here’s the script in action:

# ./docker_image_find_tag.sh -n traefik -i 96c63a7d3e50 -f 1.7. -l 10 -v

Using IMAGE_NAME: traefik
Using REGISTRY: https://index.docker.io/v2
Found Image ID Source: sha256:96c63a7d3e502fcbbd8937a2523368c22d0edd1788b8389af095f64038318834
Found Total Tags: 610
Found Tags (after filtering): 178
Limiting Tags to: 10
Limit reached, consider increasing limit (-l [number]) or use more specific filter (-f [text])

Found Tags:
v1.7.21-alpine
v1.7.21
v1.7.20-alpine
v1.7.20
v1.7.19-alpine
v1.7.19
v1.7.18-alpine
v1.7.18
v1.7.17-alpine
v1.7.17

Checking for image match..
Found match. tag: v1.7.20
Image ID Target: sha256:96c63a7d3e502fcbbd8937a2523368c22d0edd1788b8389af095f64038318834
Image ID Source: sha256:96c63a7d3e502fcbbd8937a2523368c22d0edd1788b8389af095f64038318834

This example is searching for an image named traefik, with an image ID of 96c63a7d3e50 (which we got from running docker images.

The total number of tags for traefik images is 610! You could use this script to check every one, but that will take a minute or two. Instead, you can filter the results a bit. I *think* I’m running something in version 1.7.x. I’m also limiting the search to 10 tags in this example to keep the output small.

And the find version tag script found it! The local image ID matches an image ID on the Docker Registry with a tag of 1.7.20!

You can find the script on GitHub: https://github.com/ryandaniels/docker-script-find-latest-image-tag

Some issues to note:
Issue #1: If the image no longer exists on the Docker Registry. You obviously won’t find it.
Issue #2: The script doesn’t work for Windows images. There are no manifests available for those.

Side note: In this example I’m using the traefik image. What is traefik? It’s “The Cloud Native Edge Router” which means it’s a reverse proxy and load balancer for HTTP and TCP-based applications. It works really well from my experience! Just be careful when upgrading from version 1 to version 2.

Conclusion

In conclusion, we ran the find docker image version script to match all image ID’s on Docker Hub against the local docker image that’s only tagged as latest. And we found a match, so we know what version we are running!

Now that we have a versioned image tag, we will update our running containers to use that specific version. And never use latest again!

Check out other interesting articles about Docker.