Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

Use a digest when you need reproducibility, a verified semantic-version tag when you need a readable release label, and latest only when you intentionally want a moving channel. Docker tags are names that can be moved; digests identify immutable image content. Omitting a tag silently selects latest, but that label does not guarantee the newest software release.

What a Docker image reference contains

A Docker image reference identifies a repository location and, optionally, a tag or digest. Its general form is:

[HOST[:PORT]/]NAMESPACE/REPOSITORY[:TAG]

If you omit the host, Docker uses Docker Hub. If you omit the namespace for a Docker Hub Official Image, Docker uses the library namespace. If you omit the tag, Docker uses latest.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

For example, these references address different levels of specificity:

#1 Best Overall
Sale
Compressed Air Duster,130000RPM Super Power Cordless Air Duster,Rechargeable Brushless Blower,3 Gear Adjustable Blower with LED Light,Dust Remover for Computer/House/Outdoor/Car
  • Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
  • With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
  • Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
  • Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
  • Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
  • alpine is shorthand that ultimately selects the latest tag in the Docker Hub library namespace.
  • alpine:3.21 names a repository and tag.
  • registry.example.com/team/app:1.2.3 names a private or alternate registry, namespace, repository, and tag.
  • registry.example.com/team/app@sha256:... identifies content by digest rather than by a movable tag.

A tag and a digest answer different questions. A tag answers, “What release or channel name should a person use?” A digest answers, “What exact content should the runtime fetch?”

What the latest tag really means

It is a default label, not a promise about freshness

latest is a conventional tag. Docker chooses it when no tag is written, and many publishers move it to the image they currently consider the default release. Docker does not define a universal rule that requires latest to point to the newest version, the most stable version, or the most recently published build. Each repository can define its own tag mapping and variants.

A project might point latest at its newest stable release, a long-term-support line, a default operating-system variant, or another channel. You must read that repository’s release policy rather than infer meaning from the label alone.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Why it can change without your deployment file changing

Tags are references that a registry can retarget. If a publisher pushes a new image under latest, a later pull can retrieve different content even though your command and deployment manifest are unchanged. The same issue applies to any other mutable tag; latest is not uniquely mutable.

Using latest is reasonable for a local experiment or a deliberately floating development environment where automatic updates are useful and occasional breakage is acceptable. It is a poor default for production because an ordinary restart, rescheduled task, or newly created machine can receive a different image than an earlier instance.

What happens when the tag is omitted

These commands do not mean “give me whatever version is newest according to Docker”:

docker pull alpine
docker run alpine

They mean “use the repository’s latest tag.” Make the channel explicit when that behavior is intentional, or write an exact tag or digest when it is not:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
docker pull alpine:3.21
docker pull alpine@sha256:EXACT_DIGEST

How semantic-version tags work

The meaning of MAJOR.MINOR.PATCH

Semantic Versioning 2.0.0 gives a version number meaning only when the publisher follows the specification. The core form is MAJOR.MINOR.PATCH:

Rank #2
EVEO® Screen Cleaner Spray Kit (Streak-Free) TV Screen Cleaner for Smart TV, Lcd, LEd, Oled | Computer Screen Cleaner Spray and Wipe Microfiber Cloth - TV, Monitor, Laptop, iPad, Car - 6.7oz 1 Pack
  • Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
  • Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
  • Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
  • Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
  • Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
  • MAJOR increases for incompatible API changes.
  • MINOR increases when backward-compatible functionality is added.
  • PATCH increases for backward-compatible bug fixes.

Pre-release identifiers such as 1.2.3-rc.1 and build metadata such as 1.2.3+build.7 are optional SemVer extensions. A repository can also use numbers that look semantic without actually applying those rules. A tag named 2026.10, stable, or even 1.2.3 carries no guaranteed compatibility policy unless its publisher documents one.

Why a version tag is not automatically permanent

SemVer states that once a versioned package has been released, its contents must not be modified; modifications should be released as a new version. That is a rule for publishers, not an automatic Docker registry safeguard. A registry can allow an image publisher to retarget 1.2.3 unless an immutability policy prevents it.

Consequently, a semantic-version tag is more informative than latest but less authoritative than a digest. An exact patch tag is often intended to remain stable, yet you should verify the publisher’s policy and, for controlled environments, record the digest that the tag resolved to.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

How version ranges are represented in practice

Docker does not interpret a tag such as 1.2 as a SemVer range. It is simply the literal name 1.2. Whether it moves to 1.2.1, 1.2.9, or another build is entirely up to the repository owner. Likewise, 1 might be a major-release channel, a manually maintained alias, or an unused tag. Treat every tag as a string with publisher-defined behavior.

What a Docker digest is

Content addressing and immutability

A digest is a cryptographic, content-addressed identifier, commonly displayed with the sha256: algorithm prefix:

registry.example.com/team/app@sha256:0123456789abcdef...

Unlike a tag, a digest is immutable. It identifies the exact image content addressed by that value, so pulling the same digest repeatedly selects the same content instead of following a tag that may have moved. Docker’s best-practices guidance describes the operational result this way: pinning an image to a digest guarantees that you continue using the same image version even if a publisher replaces the tag with a new image.

Why digests matter in production

Digest references support reproducible builds, deterministic deployments, audit trails, and reliable rollback. A deployment record containing only app:1.2.3 may be ambiguous if that tag was later retargeted. A record containing app@sha256:... identifies what was actually approved.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

You can retain a readable tag beside the digest for humans. A reference such as app:1.2.3@sha256:... communicates the intended release while forcing the runtime to use the specified content. The digest is the authority; the tag is descriptive context.

Rank #3
Sale
BladeHawks RGB Gaming Mouse Pad Extra Large Extended 31.5x12 Inch-Black | LED mouse pad with 14 lighting modes, covers keyboard & mouse, anti-slip rubber base, waterproof surface, USB powered
  • 【Large size】:Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
  • 【LED backlight mouse pad】:Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
  • 【Anti-slip rubber base】:Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
  • 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
  • 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.

Platform and variant considerations

One repository tag can represent multiple operating-system and architecture builds, such as Linux images for different CPU architectures. Before pinning or promoting an image, check that the tag and digest support every platform you deploy. A multi-platform tag may point to an image index that selects a platform-specific manifest at pull time. Your policy should record the target platform and, where your tooling exposes them, the relevant index and platform-specific digest values.

Tags and digests compared

Reference style Human readability Update behavior Reproducibility Typical use
latest High Usually moves when the publisher updates its default channel; also selected when a tag is omitted Low unless paired with a digest Local development, demonstrations, or deliberately floating channels
Semantic-version tag such as 1.2.3 High Depends on publisher discipline and registry mutability; the number alone does not enforce permanence Medium by convention; high only when immutability is enforced or a digest is pinned Release communication, controlled upgrades, and changelog references
Digest such as repo@sha256:... Low Immutable content identity High Production deployment, provenance, compliance, and deterministic rollback

Are Docker tags immutable?

The default is generally mutable

Docker’s build guidance warns that tags can be updated to point to a new image. For example, alpine:3.21 can resolve to one patch release today and a different patch release after a rebuild months later. The tag text has not changed; its target has.

Docker Hub immutability controls

Docker Hub repositories provide tag-immutability settings. The available policies described by Docker are:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  • All tags are mutable (the default): any tag can be retargeted.
  • All tags are immutable: existing tags cannot be updated, including latest.
  • Selected tags are immutable: a regular expression identifies the tags that cannot be changed, while other tags remain mutable.

When immutability is enabled for a tag, publishing a new image requires a new tag name. For example, instead of overwriting 1.2.3, a publisher would release a distinct version such as 1.2.4 or another documented identifier.

Registry policy is part of the reference’s meaning

The same-looking tag can have different guarantees in different registries or repositories. A team-managed registry may enforce immutable release tags, while another repository may allow every tag to move. Document the policy with your image source; do not assume that a familiar naming convention is an enforcement mechanism.

Which reference should you use?

For local development

Use latest or another floating channel when automatic movement is useful and you can tolerate a changed dependency. This minimizes manual edits, but it also means that a fresh clone or rebuild may not reproduce yesterday’s environment. If a bug appears, capture the resolved digest before trying to diagnose it so you know which image actually ran.

For CI and release testing

Use an explicit semantic-version tag that matches the release under test. Record the digest resolved during the job, especially when the test result will approve a release or become evidence for a later deployment. This gives engineers a readable release name while preserving the exact artifact that passed testing.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

For production

Deploy a reviewed digest. Keep the semantic-version tag in a comment, release record, deployment annotation, or combined image reference when that improves readability, but make the digest the value that controls what is pulled. Review digest changes as you would review a binary or dependency change, and update them deliberately rather than allowing a running system to follow a moving tag.

Rank #4
Sale
Vaydeer Wrist Rest for Keyboard and Mouse, Computer Ergonomic Wrist Support Pad, Soft Memory Foam Arm Cushion for Desk, Palm Hand Office Laptop Typing
  • 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
  • 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
  • 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
  • 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
  • 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.

For rollback

Store the digest used by every production rollout. A rollback then consists of selecting a previously approved digest, subject to the same platform and security checks as a forward deployment. A tag-only rollback can fail to restore the old image if that tag was retargeted after the original release.

A practical workflow for resolving and pinning an image

1. Select a readable release or channel

Choose a documented semantic-version tag for a controlled release, or choose a floating tag only when that behavior is intentional. Avoid leaving the tag blank because omission silently selects latest.

docker pull registry.example.com/team/app:1.2.3

2. Verify the platform and variant

Confirm that the selected reference includes the operating system and CPU architectures required by your builders and deployment targets. A tag that works on one platform may resolve to a different platform-specific build elsewhere, or may not support your target at all.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

3. Resolve and record the digest

Inspect the pulled image with your Docker tooling and record the repository digest reported for the platform you intend to run. Preserve the registry, repository, digest, platform, and the human-readable tag in the release record. The tag explains intent; the digest identifies the artifact.

4. Test the exact content

Run CI and integration tests against the recorded digest, not merely against a tag that could move between test stages. If the tag changes after the first job, later jobs must still use the digest that was approved.

5. Deploy by digest

docker pull registry.example.com/team/app@sha256:0123456789abcdef...
docker run registry.example.com/team/app@sha256:0123456789abcdef...

In an orchestrator or deployment manifest, use the same digest reference and specify the intended platform where the platform is configurable.

6. Update deliberately

When a new release is approved, resolve its digest, test it, update the deployment reference, and retain the previous digest for rollback. Do not overwrite a production reference merely because a mutable tag now points somewhere else.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Common mistakes and how to correct them

Assuming latest means newest

Symptom: two machines using an untagged image run different software.

Best Value
Sale
Under Desk Cable Management Tray No Drill, Metal Mesh Cable Management Under Desk with Clamp Mount, 2 Hole Cable Tray with Wire Management and Cord Organizer for Home Office Standing Desk
  • 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
  • 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
  • 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
  • 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
  • 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.

Correction: identify the repository’s documented channel policy, then use an explicit version tag or digest. Treat latest as a named channel, not a freshness test.

Assuming a SemVer-looking tag is immutable

Symptom: a rebuild of 1.2.3 changes behavior without a manifest change.

Correction: check the registry’s immutability configuration and compare the resolved digest with the one recorded during approval. Pin the digest for environments where drift is unacceptable.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Using a floating tag in a reproducibility-sensitive pipeline

Symptom: a rebuild, audit, or incident investigation cannot determine which image was used.

Correction: capture the digest at the point of selection and pass that immutable reference through build, test, and deployment stages.

Ignoring architecture and image variants

Symptom: an image works on one runner but fails on another architecture, or the binaries differ across hosts.

Correction: verify platform support and record whether you approved a multi-platform index or a platform-specific manifest. Do not treat a tag’s existence as proof that every target is supported.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Confusing application versions with image channels

Symptom: a tag such as slim, alpine, or a date-like label is interpreted as an application release number.

Correction: document whether each tag denotes an application version, a base-image variant, an operating-system choice, or a build channel. Only tags that follow a documented SemVer policy should be read as semantic versions.

A tagging policy you can adopt

A small, explicit policy prevents most ambiguity:

  1. Use a floating tag such as latest only for development or other environments where automatic movement is acceptable.
  2. Use an explicit semantic-version tag for release communication and controlled upgrade selection.
  3. Record the resolved digest during CI and release approval.
  4. Deploy the approved digest in production, optionally retaining the semantic tag for readability.
  5. Review every digest change and retain prior digests for rollback.
  6. Enable registry immutability for release tags, or for all tags, when your registry supports it.
  7. Document platform, operating-system variant, and whether tags represent releases or channels.

This policy separates the human workflow from the machine guarantee: people discuss versions, while deployment systems consume immutable content.

Bottom line: readable tags for people, digests for certainty

latest is convenient but intentionally loose. A semantic-version tag communicates release intent and compatibility only when the publisher follows SemVer and protects the tag from retargeting. A digest is the strongest identifier because it addresses immutable content. Use the first two to make releases understandable, and use the digest wherever the same image must be rebuilt, audited, deployed, or rolled back with confidence.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.