Pin the digest for repeatable builds, then automate update pull requests so a person reviews each new digest. Docker warns that pinning means opting out of automated security fixes. Without an update process, a pin freezes whatever flaws the base image had on the day you chose it.
The tradeoff, stated plainly
Docker's best practices page says that to fully secure your supply chain integrity you can pin the image to a specific digest. It also says that in doing so you are opting out of automated security fixes. Both are true. A tag can move under you. A digest cannot. That makes builds repeatable and also makes them stale until someone changes the value.
Use an update bot
The page suggests GitHub Dependabot with the docker package ecosystem to propose updates. GitHub's supported ecosystems table lists Docker with version updates supported and security updates not supported. Read that second part carefully. The bot will open pull requests when a new version appears, but it will not raise a separate security alert for Docker dependencies. So you cannot rely on alerts to tell you a pinned base has a flaw. Compose files have their own ecosystem entry with version updates only.
A workable routine
- Pin base images by tag and digest, so humans can read the version and machines can verify it.
- Configure the update bot for every directory that has a Dockerfile or compose file.
- Require each update pull request to pass a build, tests and an image scan.
- Merge on a regular cadence, such as weekly, and sooner for flaws that matter.
- Rebuild even when no pin changed, because the cache and package layers go stale too. See rebuilding images regularly.
Gate the update pull request
An update PR is a good place for a check. Compare the scan of the new image with the old one, block if new critical findings appear, and show the diff to the reviewer. A policy gate on pull requests can do this consistently rather than depending on reviewer memory.
| Control | Catches |
|---|---|
| Digest pin | Silent tag changes |
| Update bot | Pins that never move |
| Scan on update PR | New flaws in the new base |
| Scheduled rebuild | Stale package layers |
What about multi-architecture images
A tag may point to an index that lists one image per architecture, and the digest you copy might be the index or one platform image. Be consistent and test on every architecture you ship. See which digest to pin for multi-arch images.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Should I pin digests at all?
For production images, yes, if you also run an update process. Pinning without updates trades surprise changes for stale flaws.
Will the update bot warn me about vulnerable base images?
Per GitHub's table, Docker supports version updates but not security updates. Use your scanner for vulnerability alerts.
Safeguard
Safeguard does SBOM and dependency scanning, and its policies and gates can run in CI so a bad image does not reach production. You can try a free scan before deciding anything.
Sources
Last reviewed: 19 October 2026.
