To audit a Docker Hub repository, establish the digest, actor, and release time you expected; query Docker Hub audit events for the namespace; compare each tag-and-digest event with your release and access records; then verify the tag’s current digest in Docker Hub or with the Docker CLI. An unexpected tag movement is an investigation trigger, not proof of malicious activity: normal releases, rebuilds, automation, and authorized maintenance can all repoint a tag.
What this audit can prove—and what it cannot
A Docker image tag is a human-readable name that can refer to an image. The immutable identifier is the content digest, normally shown as a SHA-256 value. Because tags are mutable by default, the same tag can point to different image manifests over time. A useful audit therefore asks three separate questions:
As an Amazon Associate I earn from qualifying purchases.
- What changed? Which repository and tag were involved, and which digest was recorded?
- Who and when? Which account or automation identity generated the event, and when did Docker Hub record it?
- Was it authorized? Does the event match an approved release, a permitted publishing identity, and the expected release window?
The Docker Hub audit event supplies evidence for the first two questions. Authorization comes from records you control: release approvals, source-control changes, CI/CD runs, deployment tickets, identity-provider logs, and access reviews. A log entry alone does not establish intent or compromise.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Docker’s reviewed API documentation also does not state an audit-log retention period, guarantee that every relevant event is retained, or describe the service as tamper-evident storage. For a high-assurance investigation, preserve the returned records independently and apply your organization’s evidence-handling and retention requirements.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Build a trusted expected-release record first
Do not begin by treating whatever Docker Hub currently shows as the baseline. If a tag was silently replaced, the current state is exactly what you need to test. Keep an independently controlled release record for each production repository and tag.
Fields to record
| Field | Why it matters | Example format |
|---|---|---|
| Repository name and namespace | Identifies the exact Docker Hub object being audited. | acme/payments-api |
| Release tag | Defines the human-facing reference that users pull. | 2026.10.3 |
| Expected digest | Identifies the exact image content, independent of later tag movement. | sha256:... |
| Publishing actor | Lets you distinguish an approved human or automation identity from an unknown one. | CI service identity or named release engineer |
| Release time | Provides a bounded window for matching audit events and CI runs. | UTC timestamp with timezone |
| Approval and build references | Connects the digest to source, build output, and an authorization decision. | Change record, commit, workflow run, or deployment ID |
Store this record somewhere separate from the repository being audited. A write-protected release ledger, security log archive, or controlled database gives you a comparison point if repository permissions are later abused. Record the digest produced by the build or release process before publishing, not only the value observed afterward.
Define the audit window
Choose a start and end time that include the approved release and a reasonable margin before and after it. Use UTC consistently. A narrow window reduces unrelated events, while a wider window can reveal a deletion, re-push, or corrective action that explains the final state. Keep the exact bounds with the investigation notes so another analyst can reproduce the query.
Query Docker Hub audit events
Docker documents the endpoint for listing audit events for a namespace as GET /v2/auditlogs/{account}. The request must be authenticated with a bearer token issued from an organization access token (OAT) that has the required resource access and scopes. Use the least privilege that allows the relevant namespace and audit-log operation.
Prepare an organization access token
- Identify the Docker organization or account namespace that owns the repository.
- Create or obtain an organization access token with access to that namespace and the scopes required by the audit-log API.
- Store the token in a protected secret manager or an ephemeral shell variable. Do not paste it into tickets, chat, shell history, or source code.
- Confirm that the identity using the token is allowed to read audit events. An authorization failure is different from an empty result and should be recorded as such.
Run a bounded, filtered request
The API supports filters for repository name (name), action, actor, and a from/to time range. The documentation example includes the action repo.tag.push. It also supports pagination with page and page_size. A shell request can be structured like this:
export DOCKER_ACCOUNT='acme'
export DOCKER_TOKEN='read-from-your-secret-store'
export REPOSITORY='payments-api'
export FROM='2026-10-16T00:00:00Z'
export TO='2026-10-17T00:00:00Z'
curl --fail --silent --show-error
-H 'Authorization: Bearer '"$DOCKER_TOKEN"
'https://hub.docker.com/v2/auditlogs/'"$DOCKER_ACCOUNT"'?name='"$REPOSITORY"'&action=repo.tag.push&from='"$FROM"'&to='"$TO"'&page=1&page_size=100'Use the exact host, authentication format, and parameter encoding required by your current Docker documentation and client. If a repository name, actor, or timestamp contains characters that need URL encoding, encode the value rather than concatenating it raw. Keep the request parameters, response, and retrieval time together in the case record.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Read the event fields
A pushed-tag event example contains these top-level fields:
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →account: the namespace associated with the event.action: the operation, such asrepo.tag.push.actor: the user or identity attributed to the action.name: the repository name.timestamp: when Docker Hub recorded the event.data: event-specific details, includingtaganddigest.
Do not assume that the first page is complete. Follow the pagination information returned by the API, requesting subsequent values of page until the bounded query is exhausted. If you filter by actor while hunting for an unknown publisher, run an unfiltered query as well; an actor filter can hide the very event you are trying to identify.
Preserve the raw response
Save the unmodified response, the request URL without the bearer token, the token identity, query bounds, and retrieval timestamp. Generate an internal checksum for the saved file if your evidence process requires one. Work from a parsed copy for analysis, but retain the original so fields and pagination metadata can be rechecked.
Compare each event with release and access records
For every push that could affect the tag, compare the event’s repository, tag, digest, actor, and timestamp with your expected-release record. The following patterns help prioritize investigation without labeling an event prematurely.
| Observation | What it may mean | Next verification |
|---|---|---|
| Expected actor, expected tag, expected digest, and an approved release time | Consistent with the planned publication. | Match the digest to the build artifact and deployment record; close the event only after those links are documented. |
| Expected tag but a different digest | Could be a rebuild, emergency fix, multi-architecture manifest update, or an unauthorized replacement. | Check build outputs, source changes, release approvals, and whether the new digest was intentionally published. |
| Unknown actor or unfamiliar automation identity | Could be a newly rotated credential, delegated publisher, or misuse of access. | Review organization membership, OAT ownership and scopes, CI secret use, identity-provider logs, and recent permission changes. |
| Push outside the approved release window | May indicate a scheduled job, retry, maintenance action, or unauthorized activity. | Correlate with CI schedules, retry logs, incident records, and the actor’s activity across repositories. |
| Several pushes or a deletion followed by a push | Can occur during a failed release or rollback, but can also obscure an unwanted replacement. | Reconstruct the sequence in timestamp order and compare every digest with build and deployment records. |
| No event in the queried range | The range, filter, permissions, or log availability may be wrong; absence is not proof that no change occurred. | Widen the time range, remove restrictive filters, verify pagination and token scopes, and document the API’s response. |
When the actor and digest are both unexpected, treat the repository and associated credentials as potentially exposed while you verify facts. Avoid deleting evidence or immediately overwriting the tag; those actions can destroy the state you need to reconstruct.
Free tools Windows power users keep installed
One-click scans. No signup required.
Verify the repository’s current state
Inspect the tag in Docker Hub
Open the repository’s Tags view in Docker Hub and locate the relevant tag. Record the displayed digest, the tag name, and the observation time. Compare that digest with the independently retained expected value and with every relevant audit event. A current match does not erase a prior unauthorized movement if the tag was changed and later restored.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Inspect local images
On a machine that has pulled the image, Docker documents:
docker images --digestsThe output helps you see the repository, tag, and digest known to that local Docker engine. Confirm that you are examining the intended repository and platform; a multi-architecture image can resolve to platform-specific manifests while the tag identifies a manifest list. For an exact pull, use a digest-qualified reference rather than a mutable tag:
docker pull acme/payments-api@sha256:YOUR_RECORDED_DIGESTReplace the digest with the value from your trusted release record. Keep the digest in deployment configuration, lock files, or another controlled artifact when reproducibility matters. A tag-only deployment can silently receive a later image if the tag is repointed.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesDistinguish tag, manifest, and layers
The digest is the content-addressed identity of the referenced image or manifest. A tag is only a name-to-digest association. If a digest differs, compare the manifests and image configuration used by your build and deployment systems; do not infer a source-code change solely from a tag change. Conversely, matching a digest proves that the same content is referenced, not that the publishing action was authorized.
Trace the publisher through identity and CI/CD records
Once an audit event gives you an actor and time, pivot into systems that can explain the action:
- Organization access: Check whether the actor was a member, administrator, service account, or delegated identity at the event time. Review invitations, removals, role changes, and token rotations.
- Organization access tokens: Identify which OAT or automation credential could have produced the event. Verify its owner, resource access, scopes, creation date, last rotation, and whether it was used by more repositories than intended.
- CI/CD execution: Match the timestamp and tag to a successful, retried, cancelled, or manually rerun job. Confirm the source revision, build inputs, image digest, registry login step, and approval gate.
- Source and release controls: Check the change request, reviewer approval, release branch protection, and deployment record. An approved change should explain why the digest changed.
- Host and identity telemetry: If the actor is a human, review sign-in and session records for unusual location, device, or time. If it is automation, inspect runner logs and secret-access events.
Keep a timeline in UTC that places the Docker event beside the release, CI, token, and access-control events. If no legitimate path explains the push, revoke or rotate the suspected credential according to your incident process, preserve evidence, and assess whether any deployment consumed the unexpected digest.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Prevent unwanted tag movement with immutable-tag controls
Docker documents immutable tags as “image tags that, once pushed to Docker Hub, cannot be overwritten or deleted.” The feature is currently labeled beta. Docker Hub’s default behavior remains that tags are mutable.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Choose an immutability policy
| Policy | Use case | Trade-off |
|---|---|---|
| All tags immutable | Strict repositories where every published reference must remain permanent. | Any correction requires a new tag; existing automation that republishes a tag will fail. |
| Regex-selected tags immutable | Protect release tags such as versioned production builds while allowing development tags to move. | Regex mistakes can leave critical tags mutable or block expected publishing patterns. |
| Mutable tags with digest-pinned consumers | Teams that need moving development channels but deploy exact digests. | Requires disciplined digest recording and deployment review; the tag itself remains replaceable. |
Administrators can configure immutability for every tag or select tags with regular-expression rules. Docker also documents an administrative API update operation and an endpoint that verifies whether a tag matches the configured regex. Use those administrative operations only with an appropriately privileged account, and record policy changes as part of change management.
Test before enforcement
- Inventory every workflow that pushes, retags, deletes, or rolls back images.
- Test the intended regex against representative release, development, hotfix, and multi-architecture tag names using Docker’s verification operation.
- Run the publishing automation in a non-production repository or controlled test tag.
- Confirm that a legitimate first push succeeds and a second overwrite is rejected for protected tags.
- Update rollback procedures to publish a new versioned tag or deploy a previously recorded digest instead of overwriting the old release tag.
- Enable the policy during a change window and monitor failed CI jobs.
Immutability prevents replacement or deletion after publication; it does not tell you whether the first publication was authorized. Continue to retain expected digests and audit events.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Use webhooks for prompt notification
Docker Hub webhooks can send an HTTP POST to a configured destination after repository push events. A receiver can alert an on-call team, open a review ticket, or trigger a comparison against the expected-release record.
Design the receiver as a notification component, not as your sole evidence store. The reviewed documentation does not describe webhooks as durable or tamper-proof audit storage. Authenticate requests using the receiver’s supported mechanism, restrict the destination, log delivery and processing failures, and copy the event into independently controlled storage. Include repository, tag, digest, actor information when available, and the webhook receipt time in the alert so an analyst can begin the API-based reconstruction.
Understand signing and Docker Content Trust limits
Docker Content Trust is disabled by default. When enabled, Docker CLI operations on tagged images can require signed tags. Signing addresses publisher trust and verification of signed references; it does not replace audit-log correlation, access review, or digest comparison. A signed image can still be published by an identity whose authorization you must investigate, and a tag can still be a poor historical record if you do not preserve the digest and event.
Docker’s Content Trust documentation states that the Notary v1 service at notary.docker.io will shut down on December 8, 2026. Do not design a long-term control plan that assumes this legacy service will remain available after that date. Confirm the current supported signing workflow, client behavior, and migration guidance before enabling or expanding a trust policy.
End-to-end investigation runbook
- Freeze the question: Write the repository, tag, suspected change time, expected digest, expected publisher, and business impact.
- Protect the baseline: Retrieve the expected-release record from independent storage and preserve its original metadata.
- Query broadly first: Use
GET /v2/auditlogs/{account}for the namespace with a bounded time range, then filter by repository andrepo.tag.pushafter confirming the response format. - Paginate completely: Request every
pageusing an appropriatepage_size; retain each raw response. - Normalize timestamps: Convert event, CI, access, and deployment times to UTC without discarding the original values.
- Build the event timeline: For each event, list account, action, actor, repository, tag, digest, and timestamp.
- Check present state: Compare the Docker Hub Tags view and
docker images --digestsoutput with the expected digest. - Correlate authorization: Match actor and time to approvals, CI runs, OAT use, organization membership, and identity telemetry.
- Contain when necessary: If no approved explanation exists, follow your incident process for credential rotation, access restriction, deployment review, and evidence preservation.
- Document the disposition: Record whether the change was authorized, unexplained, or confirmed malicious, and cite the exact records supporting that conclusion.
Troubleshooting common audit problems
The API returns unauthorized
Check that the bearer token was issued from an organization access token, that it has the required namespace resource access and scopes, and that the account in the path is the owning namespace. Do not solve the problem by sharing a broad personal credential. Record the failed request and retry with a correctly scoped token.
The query returns no events
Verify the namespace, repository spelling, action filter, UTC bounds, pagination, and token permissions. Remove the actor and action filters temporarily, widen the time range, and compare the result with a known recent event. Because the documentation does not promise a retention window or complete historical coverage, an empty response cannot establish that a change never happened.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallThe tag shows the expected digest now
Review the full event sequence rather than stopping at the current state. A tag can be changed, then restored by an authorized rollback or by an attacker attempting to conceal activity. Compare every recorded digest with build and deployment records.
Immutability breaks a release pipeline
Determine whether the workflow is trying to overwrite or delete a protected tag. Change the workflow to publish a new versioned tag or deploy a digest, and test the regex and policy in a non-production repository before changing the production rule. Do not disable protection as an untracked emergency workaround.
A webhook alert has incomplete context
Use the alert as a prompt to query the audit API and inspect the repository state. Check receiver logs for delivery failures and preserve the webhook payload with its receipt time, but do not treat it as a complete historical record.
Which control answers which question?
| Control | Primary purpose | Evidence produced | Operational requirement | Important limitation |
|---|---|---|---|---|
| Docker Hub audit API | Historical investigation | Account, action, actor, repository, timestamp, tag, and digest in event records | Organization access token with required resource access and scopes; complete pagination | Documented retention and tamper-evidence guarantees are not stated. |
| Digest comparison | Current-state and artifact-identity verification | Exact content-addressed digest from the release record, Docker Hub, or local image metadata | Independent expected digest and correct repository/platform context | Does not identify who changed a tag or whether publication was authorized. |
| Immutable tags | Prevention | Policy-enforced rejection of overwrite or deletion for protected tags | Administrator configuration, tested regex rules, and compatible publishing automation | Feature is beta; default tags remain mutable; it cannot validate the first push. |
| Webhooks | Prompt notification | HTTP POST after repository push events and a receiver-side alert | Configured endpoint, secure receiver, delivery monitoring, and independent storage | Not documented as durable or tamper-proof audit storage. |
| Content Trust and signing | Publisher-signature verification | Signature checks for tagged images when configured and supported | Client and repository trust configuration | Disabled by default; legacy Notary v1 service shutdown is scheduled for December 8, 2026. |
Decision rule for an unexpected change
Classify a tag movement as authorized only when the event’s actor, time, tag, and digest all match an approved release path. If the digest or actor is unexpected, preserve the records and investigate through access-control and CI/CD history before deciding whether the cause was a rebuild, rollback, maintenance action, credential misuse, or compromise. Use digest-pinned deployments and tested immutability policies to reduce the chance that a mutable tag can silently change what your systems run.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
