# GOOD:
image: "nginx:1.21.6"
only full hash reference.
# GOOD:
image: "nginx:1.21.6"
only full hash reference.
Deletion is possible within limits but it also is with Docker. All the hashes in the world won't bring back a deleted image.
artifacts being removed is much less of a problem as artifacts being spoofed with malicious content.
> This brings up an interesting side point, in that Docker Hub and most other registries allow mutable tags by default. So nginx:1.21.6 might not be the same image today as it was yesterday. In reality, you probably need a mechanism to enforce tag immutability: e.g., your own registry mirror, or referring to images by SHA)