You can reference docker images by their SHA digest which is immutable, e.g.:

    docker pull redis@sha256:619af14d3a95c30759a1978da1b2ce375504f1af70ff9eea2a8e35febc45d747