Docker Hub Tag and Digest Watchlist

DevOps/release teams periodically inspect exact deployment tags and recent upstream tag evidence before pinning immutable digests or preparing update reviews.

Input

• images: One to ten namespace/repository[:tag] values. Exact tag when supplied; otherwise most recently updated tags. Use library/ for official images. Default: ["library/python:latest", "library/nginx:latest"].
• tagsPerRepository: Maximum recently updated tags for each untagged input; one source page only. No full historical enumeration. Default: 10.
• maxItems: Global delivered tag/snapshot cap, also limited by the PPE event budget. Default: 100.

Output

• type: Row kind.
• sourceUrl: Official API link for this tag. Recent-list mode constructs it from the returned tag name; the individual tag endpoint is not fetched.
• fetchedAt: UTC observation time.
• repository: Matched namespace/repository.
• tag: Exact tag or recently updated tag name.
• status: present or tag-not-found; tag-not-found requires a valid public repository.
• digest: Top-level tag digest if present in source.
• platforms: Architecture/OS/variant/digest/size per published image; unknown attestations are not runtime platform evidence.
• lastUpdated: UTC tag update time.
• lastPushed: UTC tag last push time if provided.
• totalTags: Upstream repository tag count in recent mode; null for exact mode.
• repositoryTagsTruncated: Recent tag source has further pages beyond tagsPerRepository or the output cap.
• reason: Evidence outcome; source metadata is not a security scan or availability guarantee.

Pricing

Price: $0.002 per delivered image-tag-snapshot row, including only any explicitly documented useful negative snapshot. No run-start event. Local non-PPE runs save all valid rows without event charging. PPE budget is checked before acquisition and before each push; short charging fails. No trial configured.

Limits

1–10 public namespace/repository[:tag] targets; exact tag or one bounded recent page (1–100 tags). Each exact missing tag is rechecked against repository metadata before returning a negative. No login, registry pull, binaries, vulnerabilities, SBOM, signatures or private repositories. At most 21 sequential requests, 2 MiB per response, 15-second HTTP timeout, 180-second run timeout. One tag-list page only. Fail rate-limit/auth/shape/timeout; no deeper anonymous pagination or authentication workaround.

A tag 404 plus a structurally valid matching public-repository response emits a tag-not-found snapshot; repo 404 is an error. Negative tag evidence supports pre-deploy checks without claiming permanent absence.

Privacy

Exclude creator IDs, accounts, descriptions, profiles and contributor data. Only repository/tag metadata, digests, platform architecture, size and timestamps.

Sources

Official source only. Source robots are checked before acquisition and Disallow changes fail. The source does not endorse this Actor.