13.2.3.2 Digest Rollback

Digest rollback reverts a deployment using an image's precise content digest rather than a mutable tag, providing the strongest possible guarantee that a rollback redeploys exactly the same content that was previously confirmed working, immune to any tag reassignment that might have occurred since.

Why Digest-Based Rollback Provides a Stronger Guarantee Than Tag-Based Rollback

A tag, even one conventionally treated as immutable (like a commit SHA tag), is technically still reassignable within a registry — a digest, derived directly from the image's actual content, cannot be reassigned to point at different content at all.

docker pull registry.example.com/myapp@sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

This reference guarantees the exact same image content every time, with no possibility of it having been altered to point elsewhere since it was first recorded.

Recording Digests at Deployment Time for Future Rollback Use

Capturing and storing the digest of whatever's actually deployed, at the moment of deployment, ensures this precise reference is available later if a rollback becomes necessary.

docker inspect registry.example.com/myapp:production --format '{{.RepoDigests}}' >> deployment-history.log

Performing a Rollback Using a Recorded Digest

Redeploying using a previously recorded digest guarantees the exact same content as that earlier, known-good deployment.

docker pull registry.example.com/myapp@sha256:a1b2c3d4...
docker tag registry.example.com/myapp@sha256:a1b2c3d4... registry.example.com/myapp:production
docker push registry.example.com/myapp:production

Why This Matters Most for High-Stakes Production Rollbacks

While tag-based rollback is often sufficient in practice, a digest-based approach removes any residual uncertainty, particularly valuable for a critical production incident where confidence in exactly what's being redeployed matters most.

Why Digest Rollback Matters

Using content digests for rollback provides the strongest possible assurance that a rollback genuinely restores exactly the content that was previously validated, eliminating any uncertainty a mutable tag might otherwise introduce in this critical, often time-pressured recovery scenario.