Image Tag Immutability - CI/CD Glossary Definition

Image tag immutability is a registry setting that prevents an existing tag from being overwritten to point at a new image. With immutable tags, myapp:1.4.2 always resolves to the same digest, so a deploy is reproducible.

Why it matters in CI/CD

Mutable tags like latest can silently change under you between a CI build and a production deploy, breaking reproducibility and audit trails. Immutable tags (or pinning by digest) guarantee that what you tested is what you ship.

Pin by digest for certainty

Even without registry-enforced immutability, you can reference an image by its content digest (myapp@sha256:...), which is inherently immutable because it is derived from the image content.

Related guides