A tag such as bookworm-slim names a Debian release (bookworm) and a variant (slim). A tag such as bookworm-20261005 adds a build date. Floating tags move as the publisher rebuilds; dated tags are intended to name one snapshot. Your choice sets how fresh and how repeatable your builds are.
The parts of a tag
On the official Debian image page, one image can carry several tags at once. The fetched listing shows these for a single bookworm build:
bookwormbookworm-2026100512.1512
And for the slim variant:
bookworm-slimbookworm-20261005-slim12.15-slim12-slim
Reading them: a codename names the release, a number names the release or point release, a date names a build snapshot, and -slim names a smaller variant. The page also lists rolling names like stable, oldstable and testing, which change meaning over time.
Which kind of tag moves
| Tag style | Example | Moves when |
|---|---|---|
| Rolling name | stable, oldstable | A new Debian release becomes stable |
| Codename | bookworm | The publisher rebuilds this release |
| Major number | 12 | Rebuilds, within that major release |
| Point release | 12.15 | Rebuilds until the next point release |
| Dated | bookworm-20261005 | Intended to name one snapshot |
| Digest | sha256 value | Never |
Rolling names are the risky ones for a production FROM line. A move from one stable release to the next can arrive on a rebuild you did not plan.
What slim changes
Slim is a smaller variant of the same release. Fewer packages in the base means fewer things to patch and fewer files an attacker can use, but it can also mean a missing tool that your build or debug routine assumed. Test before you switch.
Which tag should go in a FROM line
Docker's best practices guide explains the tradeoff. Mutable tags give you new versions on rebuild, which is useful, but you are not guaranteed the same image on every build and you lack an audit trail of what you used. Pinning to a digest fixes both.
A workable pattern: use a codename tag with a digest, and let an automated update change the digest on a schedule. That way every build is repeatable, and a base update arrives as a reviewable change.
- Choose a codename and variant, such as bookworm-slim.
- Resolve it to a digest at build time and pin it.
- Record the tag and digest in your build metadata.
- Refresh the digest on a fixed cadence and when advisories land.
Where Safeguard fits
Safeguard's SBOM for each image records which operating system release and packages ended up inside, whatever tag was used. The free scan at https://gold.safeguard.sh/scan is an easy way to see it for one image.
Quick check
Is a dated tag the same as a digest?
No. A dated tag is a name the publisher chose, and a publisher could in principle move it. A digest identifies exact content. Use the digest if you need certainty.
Does slim mean safer?
It usually means fewer packages, which reduces what can be vulnerable. It does not replace patching or scanning.
Sources
Last reviewed: 19 October 2026.
