GoogleContainerTools/skaffold · error

invalid image %q: no digest should be specified. Use taggers

Error message

invalid image %q: no digest should be specified. Use taggers instead: https://skaffold.dev/docs/how-tos/taggers/

What it means

validateImageNames rejects artifact image names that include a digest (@sha256:...). Skaffold expects tags/digests to come from taggers and the build pipeline, not fixed into the config, so pinning by digest in the artifact image name is disallowed.

Source

Thrown at pkg/skaffold/schema/validation/validation.go:197

			parsed, err := docker.ParseReference(a.ImageName)
			if err != nil {
				errs = append(errs, wrapWithContext(c, ErrorWithLocation{
					Error:    fmt.Errorf("invalid image %q: %w", a.ImageName, err),
					Location: curLines,
				})...)
				continue
			}

			if parsed.Tag != "" {
				errs = append(errs, wrapWithContext(c, ErrorWithLocation{
					Error:    fmt.Errorf("invalid image %q: no tag should be specified. Use taggers instead: https://skaffold.dev/docs/how-tos/taggers/", a.ImageName),
					Location: curLines,
				})...)
			}

			if parsed.Digest != "" {
				errs = append(errs, wrapWithContext(c, ErrorWithLocation{
					Error:    fmt.Errorf("invalid image %q: no digest should be specified. Use taggers instead: https://skaffold.dev/docs/how-tos/taggers/", a.ImageName),
					Location: curLines,
				})...)
			}
		}
	}
	return errs
}

func validateArtifactDependencies(configs parser.SkaffoldConfigSet) (cfgErrs []ErrorWithLocation) {
	var artifacts []*latest.Artifact
	for _, c := range configs {
		artifacts = append(artifacts, c.Build.Artifacts...)
	}
	cfgErrs = append(cfgErrs, validateUniqueDependencyAliases(&configs, artifacts)...)
	cfgErrs = append(cfgErrs, validateAcyclicDependencies(&configs, artifacts)...)
	cfgErrs = append(cfgErrs, validateValidDependencyAliases(&configs, artifacts)...)
	return
}

View on GitHub (pinned to a1189de023)

Solutions

1. Remove the @sha256:... digest from the image name in skaffold.yaml
2. Use a tagger such as sha256 or gitCommit to get reproducible, content-addressed tags
3. Pin digests at deploy time (kustomize images/ Helm values) instead of in the build artifact name

Example fix

// before
build:
  artifacts:
    - image: gcr.io/my-project/app@sha256:4e3f2a...
// after
build:
  artifacts:
    - image: gcr.io/my-project/app
  tagPolicy:
    sha256: {}

// Go: reject digests in artifact image names
func hasDigest(name string) (bool, error) {
	ref, err := docker.ParseReference(name)
	if err != nil {
		return false, err
	}
	return ref.Digest != "", nil
}

if pinned, _ := hasDigest(img); pinned {
	return errors.New("remove @sha256:... from imageName; pin digests at deploy time instead")
}

When it happens

Trigger: skaffold.yaml artifact image name looks like 'gcr.io/proj/app@sha256:abc123...' — parsed.Digest is non-empty after docker.ParseReference.

Common situations: Pasting an immutable digest reference from a registry UI or 'docker inspect' output into the skaffold.yaml image field.

Related errors

• verify command expects non-zero number of test cases
• CONFIG_MISSING_MANIFEST_FILE_ERR
• INIT_CLOUD_RUN_LOCATION_ERROR
• missing apiVersion
• custom tag not provided

AI-assisted analysis of GoogleContainerTools/skaffold@a1189de023 (2026-09-05). Data as JSON: /api/errors/e488606d9e1b3a28. Report an issue: GitHub.