What is the difference between an image tag and an image digest?
A tag like 1.27 is a movable label that can be re-pointed to a different image. A digest (sha256:...) is a hash of the image contents, so it always identifies exactly one image.
Explain it simply
A tag is a name on a locker that the owner can reassign tomorrow. A digest is the fingerprint of whatever is inside the locker: change anything and the fingerprint changes.
Publishers re-push tags all the time: python:3.12-slim is updated with security patches while keeping its name, and latest moves with every release. That is convenient but means two builds a month apart may use different bases. A digest such as python@sha256:ab12... is immutable, so pulling it always gives identical bytes. Reference it as image@sha256:<hash>. You can see the digest in docker images --digests or after a push.
Common practice: use readable version tags for humans and pin digests in production deployments or enforce them with tools like admission controllers.
Example
docker images --digests nginx
docker pull nginx@sha256:0123456789abcdef... # exact, immutable
# in Kubernetes
# image: nginx@sha256:0123456789abcdef...What to say in the interview
"A tag is a mutable pointer that can be moved to another image, while a digest is a content hash that is immutable. I use tags for readability and pin digests where reproducibility and supply-chain safety matter."
Common mistakes
- Assuming myapp:1.0 will always contain the same bytes.