Practice Now
Kubernetes
Pods
Container Images
Deployment
Image ID

Get the image and SHA image ID of images in pod on Kubernetes deployment

System Design practice on Codemia

Work through 120+ system design problems with detailed solutions, from rate limiters to multi-region storage.

Practice system design
KubernetesDocker & ContainersDevOps & Deployment

Introduction

To get the container image name and SHA256 image ID of images running in Kubernetes pods, use kubectl get pods -o jsonpath or kubectl describe pod and look at the containerStatuses field. The image field shows the human-readable tag (e.g., nginx:1.25), while imageID shows the full digest (e.g., docker-pullable://nginx@sha256:abc123...). This is essential for verifying exactly which image version is running, since tags are mutable — the same nginx:latest tag can point to different images over time, but the SHA256 digest is immutable.

Quick Commands

bash
1# Get image and imageID for all containers in all pods
2kubectl get pods -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{range .status.containerStatuses[*]}  Image: {.image}{"\n"}  ImageID: {.imageID}{"\n"}{end}{end}'
3
4# Simpler: get image for a specific pod
5kubectl get pod my-pod -o jsonpath='{.spec.containers[*].image}'
6# nginx:1.25
7
8# Get imageID (SHA) for a specific pod
9kubectl get pod my-pod -o jsonpath='{.status.containerStatuses[*].imageID}'
10# docker-pullable://nginx@sha256:abc123def456...

Using kubectl describe

bash
1kubectl describe pod my-pod
2
3# Output includes:
4# Containers:
5#   nginx:
6#     Container ID:   containerd://a1b2c3d4...
7#     Image:          nginx:1.25
8#     Image ID:       docker-pullable://nginx@sha256:abc123def456...
9#     Port:           80/TCP
10#     State:          Running

JSONPath for Structured Output

bash
1# All pods with image and imageID
2kubectl get pods -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{range .status.containerStatuses[*]}{.image}{"\t"}{.imageID}{"\n"}{end}{end}'
3
4# Format as a table
5kubectl get pods -o custom-columns=\
6POD:.metadata.name,\
7IMAGE:.status.containerStatuses[0].image,\
8IMAGE_ID:.status.containerStatuses[0].imageID
9
10# Filter by deployment
11kubectl get pods -l app=nginx -o jsonpath='{range .items[*]}{.metadata.name}: {.status.containerStatuses[0].imageID}{"\n"}{end}'

Using go-template

bash
1# Detailed output with go-template
2kubectl get pods -o go-template='{{range .items}}{{.metadata.name}}:
3{{range .status.containerStatuses}}  Container: {{.name}}
4  Image: {{.image}}
5  ImageID: {{.imageID}}
6{{end}}{{end}}'

Getting Images from Deployments

bash
1# Image specified in the deployment spec
2kubectl get deployment my-app -o jsonpath='{.spec.template.spec.containers[*].image}'
3# myregistry/myapp:v2.1.0
4
5# Image actually running (from pod status)
6kubectl get pods -l app=my-app -o jsonpath='{.items[0].status.containerStatuses[0].imageID}'
7# docker-pullable://myregistry/myapp@sha256:...
8
9# Compare desired vs running across all deployments
10kubectl get deployments -o custom-columns=\
11NAME:.metadata.name,\
12DESIRED_IMAGE:.spec.template.spec.containers[0].image

Init Containers

bash
1# Init containers have separate status
2kubectl get pod my-pod -o jsonpath='{range .status.initContainerStatuses[*]}Init: {.image} -> {.imageID}{"\n"}{end}'
3
4# All containers (init + regular)
5kubectl get pod my-pod -o jsonpath='\
6Init Containers:{"\n"}\
7{range .status.initContainerStatuses[*]}  {.name}: {.imageID}{"\n"}{end}\
8Containers:{"\n"}\
9{range .status.containerStatuses[*]}  {.name}: {.imageID}{"\n"}{end}'

Scripting with jq

bash
1# Parse with jq for complex filtering
2kubectl get pods -o json | jq -r '
3  .items[] |
4  .metadata.name as $pod |
5  .status.containerStatuses[] |
6  "\($pod)\t\(.image)\t\(.imageID)"
7'
8
9# Find pods running a specific image digest
10TARGET_SHA="sha256:abc123"
11kubectl get pods -o json | jq -r "
12  .items[] |
13  select(.status.containerStatuses[] | .imageID | contains(\"$TARGET_SHA\")) |
14  .metadata.name
15"
16
17# Check if all replicas use the same image ID
18kubectl get pods -l app=nginx -o json | jq -r '
19  [.items[].status.containerStatuses[0].imageID] | unique | length
20'
21# 1 = all same image, >1 = rolling update in progress

Verifying Image Integrity

bash
1# Pin images by digest in deployment (immutable reference)
2# deployment.yaml
3# spec:
4#   containers:
5#     - name: app
6#       image: myregistry/myapp@sha256:abc123def456...
7
8# Verify running image matches expected digest
9EXPECTED="sha256:abc123def456"
10ACTUAL=$(kubectl get pod my-pod -o jsonpath='{.status.containerStatuses[0].imageID}')
11if echo "$ACTUAL" | grep -q "$EXPECTED"; then
12    echo "Image verified"
13else
14    echo "WARNING: Image mismatch!"
15fi

Across All Namespaces

bash
1# All images across all namespaces
2kubectl get pods --all-namespaces -o custom-columns=\
3NAMESPACE:.metadata.namespace,\
4POD:.metadata.name,\
5IMAGE:.status.containerStatuses[0].image,\
6IMAGE_ID:.status.containerStatuses[0].imageID
7
8# Unique images across the cluster
9kubectl get pods --all-namespaces -o jsonpath='{range .items[*]}{range .status.containerStatuses[*]}{.imageID}{"\n"}{end}{end}' | sort -u

Common Pitfalls

  • Confusing spec.containers[].image with status.containerStatuses[].image: The spec field shows what was requested (may include latest tag). The status field shows what is actually running, including the resolved tag. The imageID in status is the only immutable reference — always use it for verification.
  • Using mutable tags (latest, v1) for verification: Tags can be overwritten. nginx:latest today may differ from nginx:latest tomorrow. Always verify using the SHA256 digest from imageID. For production deployments, pin images by digest: image: nginx@sha256:abc123....
  • Empty containerStatuses on pending pods: If a pod is in Pending state (image not yet pulled), containerStatuses may be empty or missing. Check pod.status.phase first, or use status.containerStatuses[*] which returns empty rather than erroring.
  • Multi-container pods showing only the first container: containerStatuses[0] gets only the first container. For multi-container pods (sidecars, init containers), iterate with {range .status.containerStatuses[*]} or use jq to process all containers.
  • imageID format varying by container runtime: Docker uses docker-pullable://image@sha256:..., containerd uses sha256:... directly. Do not hardcode the prefix — parse the SHA256 hash after sha256: for comparisons.

Summary

  • Use kubectl get pod -o jsonpath='{.status.containerStatuses[*].imageID}' for the immutable SHA256 digest
  • image shows the tag (mutable), imageID shows the digest (immutable) — always verify with the digest
  • Use custom-columns or jq for readable multi-pod output across deployments
  • Pin production images by digest (image: app@sha256:...) instead of tags for reproducibility
  • Check both containerStatuses and initContainerStatuses for pods with init containers
Related reading
Course
Beginner
27 lessons
10 hours
System Design Fundamentals

Build a strong foundation in designing scalable, reliable distributed systems.

View the course
Track what you have practised

A free account saves your progress, solutions and study plan across every problem on Codemia.

System Design practice on Codemia

Work through 120+ system design problems with detailed solutions, from rate limiters to multi-region storage.

Practice system design
Codemia
© 2026 Codemia
Resources
Legal
Social
All Rights Reserved.