Production for a voter-registration API must not silently drift to a different image tomorrow. How should the team think about tags versus digests?
Select an answer to reveal the explanation.
Short Explanation
A tag is a sticky note that can be moved to a different box; a digest is the fingerprint of the box’s contents. Production pins that must not drift use the fingerprint (or an immutable version tag you refuse to retarget).
Full Explanation
Tags such as app:latest are mutable pointers and can be moved to another image. A content digest addresses exact bytes and does not drift when tags move. Production deployments that require reproducibility pin digests or strictly immutable version tags.