Tagging and registries

A tag is a label, a digest is an identity

Tags are mutable pointers. The same tag can point at different images tomorrow, which is convenient for a rolling tag and dangerous for a deployment you want to reproduce.

A digest is the content hash and never changes. Deploying by digest is how you guarantee that what you tested is what runs.

Tag with something traceable — the commit sha — alongside any human-friendly tag. When production is misbehaving you want to know exactly which commit built the running image.