moreover, you can also use docker digest instead of tags, that is: instead of docker pull postgresql:11 you can do docker pull postgresql@sha:xxxx....