Production for a voter-registration API must not silently drift to a different image tomorrow. How should the team think about tags versus digests?
Select an answer to reveal the explanation.
Short Explanation
A tag is a sticky note that can be moved to a different box; a digest is the fingerprint of the box’s contents. Production pins that must not drift use the fingerprint (or an immutable version tag you refuse to retarget).
Full Explanation
A mutable tag such as latest is a movable pointer: the voter-registration image that name resolves to today can be different bytes tomorrow after someone retargets the tag. A content digest addresses one exact image and does not drift when tags move. Production deployments that must not silently change should pin digests or use strictly immutable version tags that registry policy and team process refuse to retarget after release.
Digests are not cosmetic labels that change whenever a tag is retargeted; the digest identifies content while the tag’s target changes underneath. Tags are not immutable by definition—floating tags such as latest are expected to move. Preferring floating latest in production for easier rollbacks actually makes audits and precise rollbacks harder because you lose a stable identity of what ran when an incident started.
Exam caveat: an immutable-looking version tag is only as safe as registry policy—if someone retargets 1.2.3, you still have drift; digests close that hole for municipal production pins. Operational check: record the digest at deploy time, pull by digest in a second environment, confirm the image ID matches, and alert if a deployment tag unexpectedly resolves to a new digest.