VocalHyre
Sign up

Docker · Containers in practice

What image tagging strategy would you use?

MediumtagsversioningreleaseUpdated Oct 2026
Quiz this track

Short answer

Tag releases with semantic versions and the Git commit SHA, keep those tags immutable, and avoid deploying latest. Use digests for the actual deployment reference.

Tags are human-readable pointers, not identities. A useful strategy makes it obvious which commit produced an image and which release it belongs to, while keeping the deployment reference immutable.

sh
docker build -t registry.example.com/api:1.4.2 -t registry.example.com/api:sha-9f2c1ab .
docker push registry.example.com/api:1.4.2
docker push registry.example.com/api:sha-9f2c1ab
docker inspect --format "{{index .RepoDigests 0}}" registry.example.com/api:1.4.2
The version tag is for releases; the SHA tag traces back to source.

Rules that avoid pain

  • Never deploy latest; it is ambiguous and can change without a new release
  • Use semver for releases and a commit SHA for traceability
  • Treat release tags as immutable once pushed
  • Record the digest in the deployment manifest or release notes
  • Use a moving tag such as main only for development, never production

A common failure is rebuilding the same version tag with different code, which makes rollback and incident analysis unreliable. If a rebuild is necessary, publish a new version and keep the old digest available.

Tags are not a security control. Even an immutable tag policy is a registry feature, so the deployment should still reference a digest where possible.

Follow-ups you should expect

Interviewers use these to check whether the first answer was understanding or memorisation.

  1. 1Why is deploying latest a problem?
  2. 2What does the SHA tag give you that a version tag does not?
  3. 3How do you roll back to a previous image?
  4. 4Should you ever overwrite a release tag?

Say it in the interview

I tag releases with a semantic version and the commit SHA, keep release tags immutable, and deploy by digest. That makes it possible to trace an image back to source and to roll back to the exact artifact that ran before. I avoid latest in production because it is ambiguous and can change without any release process.

Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.

Related questions

MediumHow do container registries work and how do you use them safely?MediumHow do you build and publish images in CI?HardWhat would you check before running Docker in production?

Reading is step one

Now say it out loud.

Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live Docker mock interview and get scored feedback on depth, clarity and confidence.

Start a free Docker interviewBrowse all questions