Image digests

A digest (sha256:...) is the hash of an image's manifest: it names exactly one image, forever. A tag is a label that anyone allowed to push can move to another image.

How it works

docker push prints the digest; docker images --digests and docker image inspect (RepoDigests) show it for pulled images. A reference written repository@sha256:... is fetched by content: if the tag moved, the digest still gets the original image. The local IMAGE ID is another number, not the registry digest.

What breaks

Deploying a tag means running whatever it points to at pull time: a re-run pipeline, a wrong push or a stolen account changes production at the next pull, on a nightly update or on a new server. Pinning by digest needs a way to change it on purpose, through a reviewed commit, when you do want the next version.

In a terminal

docker images --digests
docker image inspect --format '{{index .RepoDigests 0}}' registry.shop.internal/shop/api:1.4.0

See it break, then fix it

Write the Dockerfile or the compose file, type the docker commands, and watch a simulated server run them through reboots, upgrades and traffic. Free to start.

Open the learning path Open the sandbox