True. For "official" Docker Hub orgs, they typically have a tag policy. There still needs to be som trust there in whether or not they'd follow that. The only

True. For "official" Docker Hub orgs, they typically have a tag policy. There still needs to be som trust there in whether or not they'd follow that. The only way to ensure you get what you started with is to use a digest. Every Docker image has a digest and that's basically a UUID for that image. If they push over the tag with another release, the new image will have a different digest. Using the image digest in your CircleCI config file (or wherever else) and you'll always get that exact image.