What Is an Image Digest?
An image digest is a content-addressable SHA-256 hash that uniquely identifies a specific container image by its exact contents. Unlike a tag, which can be reassigned to point at different images over time, a digest always refers to the identical bytes. Referencing images by digest guarantees you run exactly the image you intended.
Why it matters
Tags like "latest" are mutable and can silently change underneath a deployment, breaking reproducibility and creating a supply-chain risk. Pinning to a digest makes deploys deterministic and tamper-evident, the image-layer equivalent of pinning a dependency to a hash.
Related concepts
- Immutable, unlike a mutable tag
- Pinning by digest aids reproducibility
- A form of content addressing
Related guides
What Is a Container Registry?A container registry is a storage and distribution service for container images, where builds push and deploy…
What Is Dependency Pinning?Dependency pinning fixes dependencies to exact versions (or hashes) instead of ranges, so builds are predicta…
What Is a Reproducible Build?A reproducible build produces bit-for-bit identical output every time from the same source, letting anyone in…