A county 311 team wants immutable image tags for a resident chatbot backend so rollbacks use a known-good digest rather than a floating tag. What practice should they follow in Azure Container Registry?
Select an answer to reveal the explanation.
Short Explanation
Floating latest is like labeling every spare parts bin "whatever we put here last"—fine until you need last Tuesday's known-good chatbot back. Pin a version tag or digest in ACR so a rollback pulls the exact image that already worked for residents.
Full Explanation
Immutable image tags and digests in Azure Container Registry are the foundation of safe rollbacks for containerized civic workloads. When a county 311 team deploys a resident chatbot backend, each release should be published with a version tag (for example, a build number or semantic version) or referenced by digest. Deployments then pin that exact reference so operators can redeploy a known-good image if a new release misbehaves. Digests uniquely identify the image content; immutable tags prevent silent retargeting of the same name to different layers. That practice preserves promote-and-rollback certainty across county environments.
Always retagging every successful build as latest and deploying only that floating tag fails immutability: latest moves under you, so “rollback to latest” may pull a newer, untested build. Deleting digests after each release fails historical recoverability—environments cannot pin or restore prior chatbot images if the registry no longer holds them. Pushing untagged layers only and relying on the host to pick any matching architecture fails explicit versioning; hosts need named manifests or digests, not orphaned layers without a deployable reference.
Exam caveat: “Immutable” here means the tag or digest you deploy does not silently change meaning. ACR can enforce tag immutability policies; even without that setting, operational discipline of never reusing release tags is the concept the exam tests. Digest pins are the strongest form of immutability when tags might be mutable.
Operational check: Inspect the 311 chatbot deployment configuration for a specific version tag or sha256 digest—not latest. Verify that prior release digests remain in ACR and that a documented rollback procedure redeploys the previous pinned reference and confirms the running container’s image ID matches that digest.