image tag vs digest
also: content hash, image hash, SHA256 digest
A tag is a human-readable label for a container image (like 'latest' or 'v1.0'), while a digest is an immutable content-based identifier (a SHA256 hash) that uniquely identifies a specific image layer composition.
In container systems like Docker and Kubernetes, tags are mutable references to images, allowing you to label versions with names like myapp:latest or myapp:v1.2.3. Tags are convenient for humans but can change—the latest tag might point to a different image tomorrow.
Digests are immutable SHA256 checksums of the image's content, formatted as sha256:a1b2c3d4e5f6.... They serve as permanent, cryptographic identifiers that guarantee you're always pulling the exact same image layers, regardless of tag changes.
Example: myapp:v1.0 might point to digest sha256:abc123 today, but if the tag is reassigned, it could point elsewhere. Using myapp@sha256:abc123 always retrieves the original image. Many systems recommend digests for production deployments where immutability matters.