What is the difference between an image digest and a tag?
Learn the difference between a Docker image tag and digest, why tags are mutable, and how pinning by digest ensures reproducible, secure deployments.
Expected Interview Answer
A tag is a human-friendly, mutable label like nginx:1.25 that can be repointed to any image, while a digest is an immutable SHA-256 content hash like nginx@sha256:abc... that always identifies one exact image manifest.
Tags are convenient but not guaranteed stable: someone can push a new image to the same tag, so latest today may differ from latest tomorrow. A digest is derived from the image content itself, so it is unique and unchangeable — pulling by digest always yields byte-for-byte the same image. For reproducible builds and supply-chain security, production deployments pin by digest rather than trusting a floating tag.
- Digests guarantee reproducible, immutable pulls
- Tags give readable, memorable version labels
- Digests protect against tag repointing and tampering
- Enables verifiable supply-chain provenance
- Prevents surprise changes from a moved latest tag
AI Mentor Explanation
A jersey number like '18' is a tag — it points to whoever the selectors assign, and next season a different player may wear it. A player's biometric fingerprint is the digest: it uniquely and permanently identifies that exact person no matter what number they wear. Pinning by digest is trusting the fingerprint, not the swappable shirt number.
Step-by-Step Explanation
Step 1
Understand a tag
A tag like repo:1.25 is a mutable pointer maintained in the registry; it can be moved to a new image at any time.
Step 2
Understand a digest
A digest is a SHA-256 hash of the image manifest, e.g. repo@sha256:...; it is derived from content and cannot change.
Step 3
Find the digest
Run docker inspect or check the registry to read RepoDigests for an image you have pulled.
Step 4
Pin by digest
Reference images as repo@sha256:... in Dockerfiles and deployments for reproducible, tamper-evident pulls.
Step 5
Verify reproducibility
Two pulls of the same digest yield byte-identical images; a moved tag can yield different content.
What Interviewer Expects
- Knows tags are mutable pointers and digests are immutable hashes
- Explains that latest can silently change
- Can locate a digest via docker inspect / RepoDigests
- Recommends pinning by digest for production reproducibility
- Understands the supply-chain security angle
Common Mistakes
- Assuming a tag like latest always refers to the same image
- Believing a digest can be manually reassigned
- Thinking pulling the same tag twice always gives identical content
- Confusing the image ID with the registry digest
- Never pinning by digest in production deployments
Best Answer (HR Friendly)
“A tag is a friendly name like 'version 1.25' that can be moved to point at a different image later, while a digest is a fixed fingerprint that always identifies one exact image. Teams pin critical deployments to the digest so they always get the same, unchanged image.”
Code Example
# Pull by tag (mutable pointer)
docker pull nginx:1.25
# Find the immutable digest
docker inspect --format='{{index .RepoDigests 0}}' nginx:1.25
# -> nginx@sha256:6a2f8b28e45c...
# Pull by digest (always the exact same image)
docker pull nginx@sha256:6a2f8b28e45c...
# Pin by digest in a Dockerfile
# FROM nginx@sha256:6a2f8b28e45c...Follow-up Questions
- Why is pinning by digest important for supply-chain security?
- How do you find the digest of an image you already pulled?
- Can two different tags point to the same digest?
- What is the difference between an image ID and a RepoDigest?
- How does pinning by digest affect image update workflows?
MCQ Practice
1. Which statement about tags and digests is correct?
A tag is a movable label while a digest is a content hash that cannot change.
2. What is a Docker image digest derived from?
A digest is a SHA-256 hash computed over the image manifest, making it content-addressable and immutable.
3. Why pin production images by digest?
Pinning by digest ensures every pull yields the exact same image, protecting reproducibility and the supply chain.
Flash Cards
What is a Docker tag? — A human-friendly, mutable label (e.g. repo:1.25) that can be repointed to any image.
What is an image digest? — An immutable SHA-256 hash of the image manifest (repo@sha256:...) identifying one exact image.
How do you find an image's digest? — Inspect RepoDigests, e.g. docker inspect --format='{{index .RepoDigests 0}}' image.
Why pin by digest in production? — It guarantees reproducible, tamper-evident pulls immune to tag repointing.