Image Tag and Digest

An image tag is a name that can point to a different image over time. A digest is a content-based identifier for the referenced manifest or image index. Record the resolved reference rather than assuming a version-looking tag is immutable.

A multi-platform image index can select different platform manifests. Keep the intended operating system and architecture with the reference. A local image ID is not interchangeable with every registry manifest digest.

Promote a tested registry digest across environments and manage updates explicitly. Digest pinning identifies content; it does not prove publisher trust, absence of vulnerabilities, or identical results against changing input data.

The forms repository:release and repository@sha256:… express a name and a digest reference respectively. Keep the resolved registry digest in the release record after pushing the tested image. Pinning that reference also means that a later patch behind the tag is not adopted automatically; select, test, and promote a new digest as an explicit update.

See Containerizing Data Jobs with Docker for a worked example.

Further reading

• Docker: Running containers