Exam AI-200 Topic 1 Question 90 Discussion

Use the image ' s SHA-256 manifest digest when defining the production deployment. Azure Container Registry assigns every pushed image manifest a unique digest, and Microsoft explicitly states that pulling an image by digest guarantees the image version being retrieved , even if an identically named tag is later pushed to a different image. A digest reference has the form myregistry.azurecr.io/repository@sha256: < digest > .
Tags such as production or latest are mutable references . By default, a user or pipeline with sufficient permissions can push a different image under the same tag. Microsoft therefore warns against relying on reusable stable tags for production deployments when exact image reproducibility is required.
A scheduled rebuild also creates a new image artifact and therefore cannot guarantee that production executes the original build. In contrast, the manifest digest is content-addressed and resolves to the precise image manifest selected at deployment time.
Thus, for deterministic and immutable production image selection, reference the container image by its SHA digest rather than by a mutable tag .
Study Guide references: Azure Container Registry # image manifests and digests; image addressing; tagging
/versioning recommendations; immutable deployment references.