manifest-list: a list of manifests for different platforms.With the Docker v2 API release, it became possible to use digests in place of tags when pulling images or to use them in FROM lines in Dockerfiles.įor example: docker pull FROM digests are calculated from descriptors generated by a Docker client during the build and stored in a Docker registry and address one of a: Pinning Docker Imagesĭocker is no different. Each time an application gets built, the dependencies used are exactly the same (e.g., Maven, NPM package-lock, Go modules, etc.). Most dependency management systems (eventually) include some mechanism to tie dependencies to fixed versions. There are other reasons a Docker build won't be reproducible, such as stale Docker client caches, non-reproducible instructions in the Dockerfile, and we shouldn't ignore them either! Automatically including this new version in the application could be a costly mistake, not least if the new version resulted from a supply chain attack. Without reproducibility, it can be difficult to isolate issues introduced by dependencies from those introduced in your own application code.Ī new version of a tagged image may fix a critical bug or vulnerability that does not affect an application, and at the same time, introduce other major bugs or vulnerabilities that do affect the application. The downside of this is that each time a Docker tag is pulled, the latest version is used, and this is often not what you want if you value build reproducibility, and you really should! Simply head over to Docker Hub, choose a tag, and each time you pull the image, you'll get the latest version pushed by the authors. The Problem with Docker Tagsĭocker tags make it easy to benefit from the hard work of others by running their images directly or by creating new derived ones. That way, whenever a tag gets used to pull an image or on the FROM line in a Dockerfile, the latest version will automatically be downloaded and used. The author can publish ( push) a new version of the buster tag at any time for any reason, most likely with security and/or bug fixes. latest is just like any other tag, except that it is the default tag when pushing or pulling an image if none is specified: $ docker pull debian For example, at the time of writing, latest, buster, 10, and 10.8 all point to the same image. Multiple tags can point to the same image. Whenever a pull or build command is issued, the Docker client checks which image the buster tag currently points to and downloads it (if it isn't already cached locally). Sending build context to Docker daemon 2.048kB $ docker build -f Dockerfile-hello-world. Or similarly in the FROM line of in Dockerfiles: $ cat Dockerfile-hello-world

They make it easy to pull and run images, and for image authors to roll out updates automatically.įor example, to pull the latest Debian GNU/Linux image for the buster release: $ docker pull debian:buster How Docker Image Tags workĭocker tags are mutable named references to Docker images, much like branch refs in Git. In this article, we explore how Docker tags work, the risks and benefits of using them, and a mechanism for pinning to specific digests to bring us closer to reproducible builds.