https://stackonward.com/tags/docker-digest/Recent content in Docker Digest on StackOnwardHugoen-USFri, 11 Sep 2026 05:00:00 +0800https://stackonward.com/posts/docker-image-digest-pinning/Fri, 11 Sep 2026 05:00:00 +0800https://stackonward.com/posts/docker-image-digest-pinning/<p>Pin a Docker image digest by writing the production image as <code>repository:tag@sha256:digest</code>. The version tag shows which release you planned. The digest is the content Docker must pull. <code>latest</code>, <code>stable</code>, or a movable version tag cannot guarantee that a rebuild or rollback returns the original image.</p> <figure> <img src="https://stackonward.com/images/posts/docker-image-digest-pinning/en/image-identity-chain.svg" alt="A movable tag points to an OCI index digest, which selects amd64 or arm64 platform manifests, and the running container records the actual image" loading="lazy" decoding="async"> <figcaption>Pinning the index digest freezes the platform set. Each node still pulls the manifest that matches its architecture.</figcaption> </figure> <h2 id="why-pin-a-docker-image-digest-instead-of-a-moving-tag">Why pin a Docker image digest instead of a moving tag</h2> <p><a href="https://docs.docker.com/dhi/explore/security-concepts/digests/" target="_blank" rel="noopener">Docker&rsquo;s image digest documentation<span class="sr-only">(opens in a new tab)</span></a> defines a digest as a SHA-256 identifier of image content. A registry maintainer can retarget the same tag to a patched image. The original digest does not move with the tag.</p>