Three hosts, one tag, three images
Three hosts pull payments-gw:latest and each runs something different. Compare digests with the signed release list and the registry push log to find the image nobody released.
Briefing
payments-gw runs on three hosts, all deployed from the same compose file with image: registry.example/payments-gw:latest. A customer reported odd behaviour on one host only.
A tag is a movable pointer; a digest (sha256:…) names exact bytes. Release engineering signs and records the digest of every release.
deploy-01 · Container audit
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.