A docker image usually has 3 parts: name, tag, and digest. Images can be pulled using name, or name:tag or [email protected]:digest. Some images are multi-architecture images. In such cases, docker automatically pulls the appropriate image for the os/arch the pull command is run on. Use docker manifest inspect –verbose to view os/arch’s of an image and to get the digest. Avoid using the latest tag in a product environment since it makes rollbacks hard.