Image Tagging Strategies

A disciplined tagging strategy is essential for reliable deployments. Using only latest is an anti-pattern: it is mutable, it obscures which version is running, and it makes rollbacks impossible. Production images should be tagged with the full semantic version (2.1.0), a minor-version alias (2.1), and optionally the Git commit SHA for exact traceability. Semantic versioning communicates the nature of changes: major version bumps indicate breaking changes, minor bumps indicate new backward-compatible features, and patch bumps indicate bug fixes. Tagging with both the full version and a shorter alias lets you choose between pinning to a patch release or automatically receiving patch updates. Content-addressable image references using digests (@sha256:...) are the ultimate guarantee of reproducibility — a digest cannot be reassigned unlike tags. CI/CD pipelines should record the digest of every image pushed, enabling forensic analysis of exactly what ran in production at any point in time.

Example

#!/bin/sh
# ci/tag-and-push.sh  called from CI after tests pass
set -e

IMAGE="myuser/myapp"
VERSION=$(cat VERSION)
MAJOR=$(echo $VERSION | cut -d. -f1)
MINOR=$(echo $VERSION | cut -d. -f1,2)
SHA=$(git rev-parse --short HEAD)

# Build once
docker build -t $IMAGE:$SHA .

# Tag with all variants
docker tag $IMAGE:$SHA $IMAGE:$VERSION
docker tag $IMAGE:$SHA $IMAGE:$MINOR
docker tag $IMAGE:$SHA $IMAGE:$MAJOR
docker tag $IMAGE:$SHA $IMAGE:latest

# Push all tags
docker push $IMAGE:$SHA
docker push $IMAGE:$VERSION
docker push $IMAGE:$MINOR
docker push $IMAGE:$MAJOR
docker push $IMAGE:latest

# Record the digest for audit
DIGEST=$(docker inspect --format='{{index .RepoDigests 0}}' $IMAGE:$VERSION)
echo "Pushed $IMAGE:$VERSION digest=$DIGEST" >> release-notes.txt

HTML

Full Editor

Related Resources

Docker Reference

Complete tag & property list

Docker How-To Guides

Step-by-step practical guides

Docker Exercises

Practice what you've learned