Mutable image tags can move underneath you
A tag is a label somebody can move. The same tag can point at different content tomorrow.
Deploying by tag therefore means deploying whatever that tag currently refers to, which may not be what you tested. Referencing the immutable digest instead removes the ambiguity entirely, and costs nothing except readability.
More on Kubernetes
- A container is isolation, not a tiny virtual machinePartitions, not buildings
- Kubernetes RBAC controls API actions, not what a running container can then doChecked at the hatch, not inside the room
- A pod service account is an identityA badge on the same rail
- NetworkPolicy needs an enforcement engineHinges, but no gate
- Admission control can stop risky objects before they runStopped on the chute
- Privileged containers weaken the host boundaryThe floor is the boundary