A digest gives you reproducible builds but no automatic fixes. A tag gives you fixes you did not choose and cannot easily audit. The best pattern is a digest plus an update bot, so each base image change arrives as a reviewable pull request. Docker's own build guidance supports that approach.
How tags and digests differ
Docker's best practices page says image tags are mutable, meaning a publisher can update a tag to point to a new image. A tag like 3.21 can resolve to different builds over time.
A digest locks the exact image. The page says you are guaranteed to always use the same image version, even if a publisher replaces the tag. The tradeoff it names: digest pinning is tedious by hand, and you opt out of automated security fixes, which you probably want.
| Approach | Reproducible | Gets fixes on rebuild | Audit trail |
|---|---|---|---|
| Floating tag | No | Yes, silently | Weak |
| Digest only | Yes | No | Clear but stale |
| Digest plus update bot | Yes | Yes, via pull request | Clear |
Images are snapshots
The guidance says to rebuild images regularly with updated dependencies to keep them current. It recommends the pull flag on docker build, which forces a check for a newer base image, and the no-cache flag to refresh package manager dependencies. The two do different jobs, and the page says they can be combined.
docker build --pull --no-cache -t myapp:dev .
Without pull, a cached older base image can be reused even when a newer one exists. That is a common reason a rebuild does not pick up a fix.
Let a bot do the tedious part
The page recommends Dependabot with the docker package ecosystem, which raises pull requests to update base image tags and digests on a schedule. The stated benefit is control and an audit trail of when and how the change occurred, as opposed to silent changes from a floating tag.
Dependabot also lists dev containers, Docker Compose and Helm among its supported ecosystems, which covers many developer tooling images.
A simple policy
- Pin production and CI base images by digest.
- Enable Dependabot version updates for docker, weekly.
- Rebuild and redeploy at least monthly even when nothing changed upstream in your code.
- Scan the built image, not only the Dockerfile.
- Record which base image digest each deployment used.
Note that tooling images used inside pipelines, such as the one holding your linters and CLIs, need the same treatment as application images. They often get none.
Safeguard scans container images and ties findings back to the base layers. Try it free at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen.
Open an image result and see which findings come from the base image rather than your own layers.
Quick check
Why did my rebuild not pick up a patched base image?
A cached base image may be reused. Use the pull flag so Docker checks for a newer version.
Does pinning by digest stop security fixes?
It stops them arriving automatically. Docker notes you opt out of automated fixes, so pair it with an update bot.
Sources
Last reviewed: 19 October 2026.
