Operators retagged :release in OCIR so it now points at yesterday’s build, and a cluster that pulls :release silently changed artifacts. How should a team pin a specific push?
Select an answer to reveal the explanation.
Short Explanation
A version tag like :release can be moved to a new build. A digest (or a tag you never retarget) pins the exact push so pulls stay stable.
Full Explanation
OCIR identifies an image by repository plus version identifier or by digest. Retagging a mutable tag such as :release silently changes what pullers receive. Digests content-address a particular push; alternatively, use a tag policy that never retargets release pointers. Tenancy display names and git branch metadata are not image digests.