Container Image Tag Monitor

Compare public container registry tag inventories and produce structured rows for tag additions, removals, mutable-tag digest changes, status changes, architecture changes, and semantic-version movement.

What It Monitors

• Added and removed tags.
• Digest changes for mutable tags such as latest.
• Tag availability or status changes.
• Published time, architecture, and image size changes.
• Major, minor, patch, and prerelease semantic-version movement.

The parser accepts Docker Hub tag responses, OCI tag-list responses, generic JSON tag collections, and structured registry records. Digests are reported only when the source supplies them; the actor never derives a digest from page text.

Input

Use targets for multiple images, or provide direct single-image fields at the top level.

Field	Purpose
targets	Capped previous/current image tag comparisons.
registry	Registry type or host label.
imageName	Repository or image name.
sourceUrl / urls	Public registry API URLs. Retrieval occurs only when fetchUrls is true and current data is absent.
previousSnapshot / currentSnapshot	Docker Hub, OCI, or supported generic JSON.
previousTags / currentTags	Structured tag records.
records	Pre-paired records containing old and new tag values.
includeUnchanged	Include tags whose supported fields did not change.
includeReport	Write results, summary, and Markdown report records.
maxTargets	Image cap, from 1 through 50.
maxTagsPerTarget	Tag cap per side, from 1 through 5,000.
maxItems	Dataset row cap.
maxTextBytes	Snapshot size cap, up to 2,000,000 bytes.

{
  "registry": "docker-hub",
  "imageName": "acme/api",
  "previousTags": [
    {
      "name": "latest",
      "digest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
      "status": "active",
      "architectures": ["linux/amd64"]
    }
  ],
  "currentTags": [
    {
      "name": "latest",
      "digest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
      "status": "active",
      "architectures": ["linux/amd64", "linux/arm64"]
    },
    {
      "name": "2.0.0",
      "digest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
      "status": "active"
    }
  ],
  "maxItems": 25,
  "includeReport": true
}

Dataset Rows

Each row identifies one tag change or source diagnostic. Important fields include:

• registry, imageName, and tag.
• changeType, oldDigest, newDigest, oldStatus, and newStatus.
• oldArchitectures, newArchitectures, oldSizeBytes, and newSizeBytes.
• oldPublishedAt, newPublishedAt, versionDirection, and semverJump.
• Source identifiers, severity, score, checked time, and recommendation.
• diagnosticCode and sourceError for blocked retrieval or an empty tag parse.

Change types are tag-added, tag-removed, digest-changed, tag-status-changed, metadata-changed, and unchanged.

Stored Artifacts

• Dataset: one row per tag change, unchanged tag, or diagnostic that passes configured filters and caps.
• CONTAINER_IMAGE_TAG_MONITOR_RESULTS.json: emitted rows.
• CONTAINER_IMAGE_TAG_MONITOR_SUMMARY.json: tag, digest, status, architecture, version, diagnostic, and charge-limit counts.
• CONTAINER_IMAGE_TAG_MONITOR_REPORT.md: readable image tag change digest.

Usage Charges

The actor uses pay per event. Platform usage is included in these event prices.

Event	Price	When charged
actor-start	$0.02000	Once before paid work starts.
target-checked	$0.00650	Before each image target is processed.
snapshot-compared	$0.00650	Before a successfully prepared tag pair is compared.
change-detected	$0.01300	Before each changed tag row is emitted.
digest-generated	$0.05000	Before JSON result and summary records are written.
executive-report-generated	$0.10000	Before the Markdown report is written.

If Apify reports that a charge was limited or only partly accepted, the actor stops before the corresponding paid output. Set includeReport to false when KVS report artifacts are not needed.

Public Tasks

Five capped task inputs cover mutable tags, new version tags, removed tags, architecture changes, and a registry digest. Each task uses concrete registry data and bounded output.

Retrieval Safety

• Only public http and https URLs are accepted.
• Credentials in URLs and redirects are rejected.
• Loopback, link-local, and private network destinations are blocked unless allowPrivateUrls is explicitly enabled for controlled testing.
• Response length, retained snapshot bytes, target count, tag count, and request duration are bounded.
• Fetch failures and empty parses produce explicit diagnostic rows. Missing tags or digests are not synthesized.

Limitations

• Private registries and credentialed endpoints are not supported.
• OCI tag-list endpoints usually omit digests and image metadata; those fields remain null unless supplied by the source.
• Registry pagination is controlled by the provided URL and the actor's caps. The actor does not crawl unbounded page sequences.
• Scheduling and baseline retention are managed by the caller. Pass prior tag data into each comparison.