A container image digest is a cryptographic hash that identifies the exact contents of an image. Unlike a tag such as latest or 1.2, which can be moved to point to a different image, a digest refers to a specific image build.
Digests matter in cyber security because they let teams verify and deploy the image they intended to use. In a supply-chain attack, a trusted tag could be updated to point to a malicious image; pinning a deployment to a known digest helps prevent that substitution and supports investigation of which image was used. A digest establishes identity, not safety: a malicious image still has a valid digest. Pair digest checks with trusted provenance, scanning, and controlled publishing.