Loading request...
The user suggests that systems should allow pinning digests/hashes of container image tags. This would enable manual approval if a malicious update is pushed over an existing tag, as Docker tags are not immutable. This feature would enhance security, especially when using tools like Renovate and GitOps.
@10:52 Even better: pin the digests/hashes of the tag together so if a malicious update is pushed over the tag you have to manually approve it. Docker tags aren't immutable! And with tools like Renovate and git ops this is very doable but will take some implementation time.