Terrible advice. It doesn't solve the "immutability" problem and may give you a false sense that it does, which is a much bigger problem. Here's the "good" ex

Terrible advice. It doesn't solve the "immutability" problem and may give you a false sense that it does, which is a much bigger problem. Here's the "good" example from the article: # GOOD: image: "nginx:1.21.6" Here is the header of the source of the Dockerfile for this image: FROM debian:bullseye-slim LABEL maintainer="NGINX Docker Maintainers <docker-maint@nginx.com>" ENV NGINX_VERSION 1.21.6 ENV NJS_VERSION 0.7.2 ENV PKG_RELEASE 1~bullseye ... ... ... Notice the first line? `debian:bullseye-slim` is not "immutable". Should the `nginx:1.21.6` image auto-update when new `debian:bullseye-slim` is available? Or should it keep it what it was during the build time? I am not exactly sure how nginx does it but it would not be incorrect to do either (both address different issues and are completely valid depending on what you want to do). If you are serious about using docker, you need a private registry and you need to make a tagging policy that is best for YOUR use-case.