Track digests for evidence and tags for humans. A digest identifies exact image content and never moves, so it is the right key for scan results. A tag is a convenient label that can point to different content later. Pin by digest in production, and automate updates so pinning does not freeze security fixes.
The facts
Kubernetes documentation says tags identify versions of an image series, while digests are unique identifiers, hashes of the image content, and immutable. Tags can be moved to point to another image. If you specify both, only the digest is used for pulling. The same page advises avoiding the latest tag in production because it is harder to track which version is running and to roll back.
Docker's guidance agrees that tags are mutable, and that pinning to a digest guarantees you always use the same image.
Comparison
| Aspect | Tag | Digest |
|---|---|---|
| Readable | Yes | No |
| Moves over time | Yes | No |
| Good scan key | Weak | Strong |
| Gets fixes automatically | Sometimes | Never, by design |
| Rollback clarity | Weaker | Clear |
What this means for tracking
If your scan results are stored against a tag, then next week the same tag may be a different image, and your history lies. Store the digest with every result. Keep the tag as a label next to it.
The cost of pinning
Docker is direct about it: digests are tedious to find and update by hand, and pinning means you give up automatic security fixes. Their suggestion is to use automated update tooling, such as Dependabot with the docker ecosystem, or recommendation tools, to open update pull requests.
A workable policy
- Production references use a digest.
- A bot or scheduled job proposes digest updates.
- Updates go through the normal pipeline and scan.
- Anything not updated in a set window shows on a stale pin report.
- Never use latest in production.
Mixed rollouts
Kubernetes notes that with tags, a registry change can leave a mix of pods running old and new code. A digest removes that mix. During an incident, that matters: you can say exactly which content was running.
Quick check
If I specify a tag and a digest, which does Kubernetes use?
Only the digest is used for pulling, according to the Kubernetes documentation.
Will pinning stop my images getting patched?
It stops silent changes. You must replace the digest yourself or by automation to take patches.
Safeguard scans container images and supports policies and gates; a free scan shows findings for a sample project.
Sources
Last reviewed: 19 October 2026.
