Chapter 2 · Practice 2 of 5
Pin base images by digest for reproducible builds
Why it matters
Tags are mutable: the publisher can move node:24-slim to a new image at any time, so two builds of the same commit can differ. Pinning to a digest (@sha256:...) means every build uses the exact same base.
| Tag only | Tag plus digest | |
|---|---|---|
| Same commit, same image | Not always | Yes |
| Picks up base updates | Automatically | Through a pull request |
| Readable by humans | Yes | Yes, keep the tag next to it |
The cost is that you must update digests yourself, so pair pinning with a bot. Docker's docs point to Dependabot's docker ecosystem, which opens pull requests when a new digest is published.
Example
FROM node:24-slim@sha256:<digest-from-docker-buildx-imagetools-inspect>
# .github/dependabot.yml
# - package-ecosystem: "docker"
# directory: "/"
# schedule:
# interval: "weekly"