Docker Interview Question 10: Pin Image Digest
Docker Interview Questions · Test 1 · question 10 of 10
A Dockerfile starts with FROM python:3.12.4-slim. Builds run on fresh CI runners with no local image cache. Two builds of the same commit, three weeks apart, produced images with different base-layer contents and OS package versions. The team assumed a full patch-version tag was fixed.
Auditors now require that every build uses exactly the same base image until someone deliberately changes the Dockerfile. What should you do?
Show answer and explanation
Answer:
Tags are mutable: a publisher can push a new image under the same tag (for example, a rebuild with security patches), and pulling the tag then gets the newer image. A digest is an immutable identifier of the image content. Pinning the base image to a digest guarantees that the same image version is always used, even if the publisher replaces the tag. Keeping the tag next to the digest is only for readability.
Option B still uses a tag. However specific, it remains mutable and can be re-pushed.
Option C only stops Docker from checking for a newer version of an image that is already cached locally. The CI runners start with no cache, so every build still pulls whatever the tag points to that day.
Option D disables layer reuse. It does not pin the base image and does not make builds identical; it resolves the tag afresh each time.
References: docker image pull - pull an image by digest; Building best practices - pin base image versions; docker buildx build (`--pull`)