We've encountered errors where either we hit the Docker Hub rate limit, or an image tag has been overwritten and therefor SHA's do not match. This script will loop through images currently in use and attempt a Docker pull and print out any errors.

docker-image-errors.sh

# loop through services and get names
for SERVICE in $(docker service ls --format "{{.Name}}"); do
    # get the full image:tag@sha used by the service
    IMAGE=$(docker service inspect $SERVICE --format "{{.Spec.TaskTemplate.ContainerSpec.Image}}")
    # try image pull and capture error for printing
    ERROR="$(docker pull -q $IMAGE 2>&1 > /dev/null)"
    if [[ ! -z $ERROR ]]; then
        printf "$SERVICE: $IMAGE\n\t$ERROR\n"
    fi
done