A container image reference names where an image lives and which version you mean. Docker's format is host and optional port, then namespace and repository, then an optional tag. Omit parts and Docker fills in defaults: Docker Hub as the host, library as the namespace and latest as the tag. A digest pins exact content.
The parts
Docker's documentation gives the form as HOST[:PORT]/NAMESPACE/REPOSITORY[:TAG] and explains each part.
| Part | Meaning | Default if omitted |
|---|---|---|
| Host | The registry location | docker.io, Docker Hub |
| Port | Optional registry port, such as 5000 | None |
| Namespace | Usually a user or organization | library, reserved for Docker Official Images |
| Repository | Identifies the specific image, required | None |
| Tag | A version or variant label | latest |
Examples from the docs: example.com:5000/team/my-app:2.0 has host example.com, port 5000, namespace team, repository my-app and tag 2.0. The bare name alpine means host docker.io, namespace library, repository alpine and tag latest.
Why defaults are a risk
A short name like alpine silently resolves to a public registry and the latest tag. If your build or manifest uses bare names:
- You depend on a public host even where you meant an internal one.
- The tag moves, so the image changes between builds.
- A misspelling or a name clash can pull something you did not intend.
- Your scan results describe a tag, not a fixed image.
Write references that are safe
- Always include the host, so the source is explicit and matches your allowlist.
- Use full version tags rather than latest. See what Kubernetes does with latest.
- Add the digest for anything that runs in production. A reference can combine a tag for readability and a digest for exactness, for example
registry.example.com/team/my-app:2.0@sha256:.... Check how your tooling treats a reference that carries both. - Enforce this with policy at admission, so a bare reference is rejected. See require image digests.
- Keep a list of approved registries and fail builds that pull from elsewhere.
The tag grammar itself comes from the OCI distribution specification: see how to tag release images.
Where Safeguard fits
Safeguard's container image scanning reports vulnerabilities and packages per image, and its policy gates can act on what the reference actually resolves to. You can try a free scan.
Try it yourself
Click through it at your own pace, or open it full screen. Check which image name and layers the findings are attached to.
Quick check
What does a bare name like alpine resolve to?
Docker Hub as the host, library as the namespace, alpine as the repository and latest as the tag.
Why add a digest?
A tag can be moved, while a digest identifies exact content, so the deployed image is the one you tested.
Sources
Last reviewed: 19 October 2026.
