An immutable digest is a cryptographic hash that identifies the exact contents of a container image or other software artifact. Unlike a mutable tag such as latest, a digest points to a specific version, so it cannot silently shift to different contents while keeping the same identifier.
Pinning deployments to digests helps teams verify what was built, reviewed, and run, reducing the risk of an unexpected or poisoned release entering a system through an updated tag. In practice, deployment manifests and CI pipelines can reference an image by digest, then check signatures and provenance before use. A digest does not prove that an artifact is safe; it makes the artifact’s identity stable and easier to audit.