Cite the container image by its digest, not only its tag. A tag such as 24.04 can be repointed to a newer image, while a digest is an immutable identifier of the exact content. Writing the full digest in your methods lets readers pull the same image you used.
Tag versus digest
Docker's reference documents both. Pulling by name and tag is convenient and, when you pull again, gets you the latest version behind that tag. Docker's guide describes the digest as an immutable identifier and shows pulling in the form name at sha256 and a long hash.
docker pull ubuntu@sha256:2e863c44b718727c860746568e1d54afd13b2fa71b160f5cd9058fc436217b30
That command comes from Docker's documentation as an example of the form. Use the digest of your own image.
What to write in methods
- The image name and the tag you used, for readability.
- The full digest, in a sentence or a supplement table.
- The date you pulled it.
- The Dockerfile or definition file, archived with a DOI. See how to get a DOI for a release.
- The host architecture if results depend on it.
| Item | Why it matters |
|---|---|
| Tag | Human readable hint |
| Digest | Exact content, cannot silently change |
| Pull date | Context for what a tag meant then |
| Build file | Lets others rebuild if the image disappears |
Why also scan before publishing
An immutable image is also an immutable set of known flaws. If the base layer holds a vulnerable library, your digest pins that library forever. Scan the image, fix what matters, rebuild, and cite the new digest. The trade off is the same one covered in pin versions without freezing vulnerabilities.
For why signing a digest beats signing a tag, see why sign the image digest, not the tag.
Keep a copy
Registries can remove images. Keep the image as an archive file, or keep a definition that rebuilds it, alongside the paper. A digest only helps if something still serves that content.
Try it yourself
Click through it at your own pace, or open it full screen. Look at what a scan finds inside an image you have pinned.
Quick check
Is a tag good enough for reproducibility?
Not on its own. A tag can be moved to different content later. A digest identifies the exact image.
Does pinning a digest make the image secure?
No. It makes the image repeatable. Any vulnerabilities inside stay until you rebuild, so scan before you cite it.
Safeguard's SBOM and dependency scanning includes container image scanning, and a free scan is available.
Sources
Last reviewed: 19 October 2026.
