Short answers to the questions teams ask most when they adopt container images from public registries. Official images are curated but still need a scan, tags move, digests do not, badges describe publishers, and caches speed pulls without vetting them. Each answer below is based on the vendor documentation listed at the end.
1. Is an official image safer than a community image?
It starts from a better place. Official images follow a written review checklist and link each tag to its Dockerfile. They can still have vulnerable packages, so scan them.
2. What is the difference between the badges?
Docker documents Official Images, Verified Publisher images and Docker-Sponsored Open Source images. The badges describe the publisher or program, not the findings in a build.
3. Can a tag change after I tested it?
Yes. Kubernetes documents that tags can be moved to point to different images. Some registries offer immutable tags as a setting, which is off by default on Docker Hub.
4. What is a digest?
A hash of the image content. Kubernetes documents digests as immutable. Pinning by digest means what you tested is what you run.
5. If I write a tag and a digest, which is used?
Kubernetes says only the digest is used for pulling.
6. Which registry does an image name without a host use?
Kubernetes assumes the Docker public registry by default, and Podman can expand short names through aliases or a list of search registries. Write the host to avoid guessing.
7. Do old tags still get patched?
Only tags still listed in an official image's library file are rebuilt. Tags removed from it remain on Docker Hub but are no longer maintained.
8. Does a pull-through cache vet images?
No. It stores and serves what upstream provides. Authenticate it, log it and scan around it. The Docker registry docs also note that a mirror with upstream credentials exposes private content to its users unless the mirror itself requires authentication.
9. Does Docker's registry-mirrors setting cover other registries?
No. Docker says it mirrors Docker Hub only.
10. Is Docker Content Trust still a good control?
Docker says it is being retired and the service is no longer reliable for pulls. Plan a move to another signing approach such as Sigstore or Notation, and meanwhile use digests and scans.
Where to go next
If you can only do three things this week, pin digests, scan on adoption, and write full registry hosts in your image references. Those three remove the most surprise for the least effort. Then add signature checks for the images that matter most and a re-scan schedule for all of them.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how findings are tracked from discovery to fix, which is what you need after the first scan.
Quick check
What is the quickest improvement for most teams?
Pin image digests in build files and scan each digest before use.
Where can I check whether an official tag is maintained?
On the image's Docker Hub page, in the supported tags list, and in the official-images repository.
Safeguard scans container images, creates an SBOM, applies policies and gates, and offers a free scan at gold.safeguard.sh/scan.
Sources
- Docker Docs: Trusted content on Docker Hub
- Docker Docs: Registry as a pull-through cache
- Docker Docs: Immutable tags
- Kubernetes docs: Images
- Podman docs: podman pull
- docker-library/official-images on GitHub
Last reviewed: 19 October 2026.
