Docker Image Tagging: Versioning for Containers
A Docker tag is a human-readable label for a specific image version, like ubuntu:22.04. You use tags to pull specific base images or version your own builds. The biggest footgun is relying on the latest tag, which is just a convention.
Why it exists
Docker images are identified by a long, unique SHA256 hash (e.g., sha256:f6e...). These are hard for humans to remember and manage. Tags provide a simple, human-readable way to reference specific image versions, making them easier to distribute and deploy.
The mental model
Think of a tag as a sticky note on a specific box in a warehouse. The box has a unique, unchangeable serial number (the image ID hash). You can put multiple sticky notes on the same box (e.g., myapp:v1.2 and myapp:latest) or move a sticky note from one box to another (retagging latest from v1.2 to v1.3). The tag is a mutable pointer to an immutable image.
How it works
The command docker tag SOURCE_IMAGE[:TAG] TARGET_IMAGE[:TAG] creates a new tag that points to the same image ID as the source. It doesn't create a copy of the image; it just adds another reference. When you run docker pull ubuntu, Docker translates this to docker pull ubuntu:latest by default. The tag latest is just a string; it has no special meaning to the Docker daemon itself.
When to use it
Always use specific tags for your base images in Dockerfiles (e.g., FROM python:3.9-slim) to ensure reproducible builds. Use semantic versioning for your own images (e.g., my-app:1.2.3). This helps track exactly what version of your code is running in a given environment.
When not to use it
Avoid using the latest tag in production deployments or CI/CD pipelines. The image that latest points to can change without warning, leading to unexpected failures or behavior drift. For true immutability, pin to a specific version tag (myapp:1.2.3) or, for maximum safety, the image's SHA256 digest.
One canonical example
A common workflow is to build an image, tag it with a version number and latest, and then push both tags. First, docker build -t my-app:1.5.0 .. Second, docker tag my-app:1.5.0 my-app:latest. Finally, you would push both tags to your registry. This makes 1.5.0 the specific, stable version, while latest provides a convenient pointer for developers who just want the newest build.
Interview question
What is the primary reason to avoid using the "latest" tag for Docker images in production or CI/CD pipelines?
- a.It always refers to an unstable, unverified development build, unsuitable for production.
- b.The image associated with the "latest" tag can be updated at any time, leading to non-reproducible builds and unexpected behavior.Correct
- c.Using "latest" requires more storage as Docker keeps a full history of all images it has ever pointed to.
- d.The "latest" tag is automatically purged by Docker after a set duration, causing deployments to fail.
Why? this is the answer
The card explicitly states that the image 'latest' points to can change without warning, leading to unexpected failures or behavior drift, making builds non-reproducible. This mutability is the core issue, not that it's inherently unstable or automatically purged.
Just read this? Test yourself on what you have been reading.
Read the original → docs.docker.com
- #docker
- #container
- #versioning
- #devops
Put your scrolling time to good use
Learn one idea, try a quiz and save useful cards for revision. Tezvyn makes it easy to learn and stay current in your tech field, a few minutes at a time.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.
We are hiring for this. Open roles that interview on docker — each one lists the topics its interview covers.
See open roles