<p dir="auto">Moving this piece from <a href="https://github.com/kubernetes/kubernetes/pull/27129/files/4a60be831efce93d7e210df47d79e7c18d5d13c2#r71607506">this comment</a>. Generally the idea is to have the kubelet to attach SHA of the image(s) running in a pod in the pod status field. This will be useful for the aforementioned image policy proposal and related image auditing capabilities.</p>
<p dir="auto"><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/erictune/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/erictune">@erictune</a> fyi</p>
<p dir="auto">The image digest from an image is much more useful to be reported with a container than just the image id.  We should return the digest as well, which would allow policy tie back to 3rd party engines as well as understanding the exact image in use.  I believe the gap today is the local graph driver doesn't preserve the digest, but that work is going on upstream in Docker to make that more generally available.</p>
<p dir="auto"><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/vbatts/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/vbatts">@vbatts</a> correct me if I missed anything about the state of Docker on this (links to issues would be helpful)</p>
<p dir="auto"><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/ncdc/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/ncdc">@ncdc</a> <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/pweil-/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/pweil-">@pweil-</a> policy around managing what images can be used on a Kubelet is a next big area of exploration - knowing exactly what is in use is a part of that</p>