Parks recommender API builds must be reproducible when ACR Tasks rebuilds from a Dockerfile. What practice should the team follow?
Select an answer to reveal the explanation.
Short Explanation
Pinning the base image digest is like etching the exact parts number on the parks recommender build order—ACR Tasks rebuilds the same bits instead of chasing a wandering 'latest' tag.
Full Explanation
Pinning the base image digest in the Dockerfile used by ACR Tasks makes parks recommender rebuilds resolve the same bits every time, which is the foundation of reproducible municipal image builds. Digests identify immutable content; floating tags can move underneath you between builds. Auditors and incident responders need to know exactly which base layers entered a civic API image.
Always using floating latest tags without recording digests fails by concept because latest can change silently, producing different images from the "same" Dockerfile over time. Allowing developers to swap base images locally without updating the Task definition fails because the cloud build no longer matches what was tested, breaking reproducibility and review. Disabling ACR Tasks and copying images from personal laptops fails because laptop layers are unverifiable in the controlled build pipeline and weaken supply-chain assurance.
Exam caveat: Pin digests for base images even if you also use curated tags; prefer digest references in production Dockerfiles. ACR Tasks reproducibility also depends on build args, context contents, and not relying on mutable remote resources during build. Signing and scanning complement but do not replace digest pinning.
Operational check: Update the parks recommender Dockerfile to reference the base image by digest, run ACR Tasks twice without context changes, compare resulting image digests/layer IDs, and confirm they match. Block CI policies that allow unpinned latest bases into municipal production Tasks.