Definition. An image digest is the SHA-256 checksum of a container image's manifest, written for example as image@sha256:…. Unlike a tag such as latest or v1.2, a digest cannot be pointed at a different image.

Why it matters. Tags are mutable pointers. Referencing by digest always gets you exactly the tested artifact, and a new image only reaches the cluster through a change in the repository. Tools such as Renovate update digests automatically as merge requests.

Example. On 21 October 2026, LiteLLM's latest and main-stable tags on Docker Hub pointed to a tampered image for around two and a half hours. Deployments that referenced an older version by digest did not pull it.

Related. Cooldown, Lockfile, GitOps, Supply chain attack