Image Digest Pinning - CI/CD Glossary Definition

Digest pinning refers to an image by its sha256 content digest rather than a tag like :latest, so the reference is immutable and builds are reproducible.

Image digest pinning references a container image by its immutable content digest (for example image@sha256:...) instead of a mutable tag, guaranteeing that every build pulls the exact same image bytes.

Tags can be repointed at new content; a digest cannot, which is why supply-chain guidance recommends pinning.

Tag vs digest

A tag such as node:20 can silently move to a new image; a digest reference always resolves to the same bytes. Pin base images and actions by digest for reproducibility and to defend against a repointed tag.

Related guides