World map

 

BM

World D5: Ship & Shield

Pin by digest: @sha256

You will learn: to pin an image by its digest, so you get the exact same bytes every time.

Checked with Docker Engine 29 on 31 Oct 2026

The problem

Your recipe says FROM node:24-alpine. Next month, the same line gives you a different base. How?

Watch

Your laptop~

  • No open hatches

Lunchboxes (containers)

  • No containers yet

Frozen packs (images)

  • No images yet

Look at the Digest: line. A digest: An image's fingerprint (sha256:…), made from every byte inside. It never moves, unlike a tag. is the pack’s fingerprint, made from every byte inside. Change one byte, and the digest changes.

Try it

$PIN holds node’s digest. Run node --version from exactly that pack: put @$PIN after the image name.

Your laptop~/kedai-api

  • No open hatches

Lunchboxes (containers)

  • No containers yet

Frozen packs (images)

  • node:24-alpine4 layers · 244MB

Watch

Pin the recipe too. Tag for people, digest for machines.

Tap the line that always gets the same base.

0 of 1 found

Predict

Someone moves node:24-alpine to a new image. Your recipe says node:24-alpine@sha256:8a32…. What do you build on?

Check

Which names can point to a different pack tomorrow?

Drag a card into a box. Or tap the card, then tap the box.

      You did it!

      You can now pin an image by its digest.

      Go deeper (optional)

      Pinning has a cost: you also pin old bugs. Let a robot bump it. Dependabot opens a pull request when the base changes (Git World 7). A wrong digest gets not found. A multi-platform image has one digest for the whole list, and one per platform.

      Real rep (optional), on your own machine:

      Real mission

      1. docker pull alpine:3.22
      2. docker run --rm alpine:3.22@sha256:PASTE-HERE echo pinned

      0 of 3 steps done · Your ticks are saved.