How do you find the sha256 digest of a running App Service container?

Steve Tooke 0

I would like to understand exactly which image containers are running for a given App Service. This requires having access to the image sha256 fingerprint, not just the image tag.

Is there anyway to query the service to get this data?

Ben Gimblett 4,330 Reputation points Microsoft Employee

2023-09-13T09:22:06.28+00:00

Hey - thanks for the question

Unless you include it when you reference the image - then the sha value wont be part of the resource graph or config settings

You also cant run docker inspect and kudu terminal doesnt have the context

However, App service does store docker logs (I dont know what the retention is) and the image sha value should be visible for the logs captured when the image is pulled

You can access them from the kudulite shell/ssh / or linked from the kudulite home page at " https://<your app name>.scm.azurewebsites.net/ "
Steve Tooke 0 Reputation points

2023-09-13T11:46:03.7633333+00:00

Hey @Ben Gimblett

Thanks for coming back, much appreciated.

I think what you are saying is that the App Service configuration only includes the image tag used to build the app – but no way to understand which image is running?

For example, if I'm using myimage:latest to build my app from.

If I build and deploy it 2-days ago the digest of myimage:latest was (e.g.) 0b56ac58fa0ee356275966ca7b80fdf1860726ee94bd26ec529d6ebdbd43ef9a.

If I have made changes to the image and push a new image to the registry tagged with myimage:latest which has digest: 9f13f5a53d118643c1f1ff294867c09f224d00edca21f56caa71c2321f8ca004

I would like to be able to find out which of these two images the web app is using?
Currently the configuration tells me myimage:latest, however that isn't the whole story.
Steve Tooke 0 Reputation points

2023-09-14T08:15:48.48+00:00

Thanks @Ben Gimblett , appreciate you taking to the time to explain.

1 answer

Ben Gimblett 4,330 Reputation points Microsoft Employee

2023-09-13T13:35:33.26+00:00
Yes as far as I can see App service doesn't store the digest anywhere other than the docker logs that are accessible to you - unless you use the image hash value as part of the identifier
Example

'<my container registry>/<name>:<digest>'

I've used the above convention with Web Apps + Azure Container Registry where the digest value replaces the tag. For docker a pull with digest (not tag) requires the form
'docker pull name@sha256:digest'

More generally; what you are experiencing is one of the issues of using the latest tag which is considered a bit of an anti-pattern by a number of folks in the community

There's loads of blog posts and comments on this, I've grabbed one at random here https://vsupalov.com/docker-latest-tag/

Referencing the image by digest isn't super readable - but using a versioning strategy with the tag is less brittle than relying on "latest" (or similar convention).
Please sign in to rate this answer.

1 person found this answer helpful.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

How do you find the sha256 digest of a running App Service container?

1 answer

Your answer