Image digests identify an image by its content. Unlike tags, they are immutable. This makes

digests preferable to tags for referencing images in Kubernetes manifests. The value

k8s.pull_image_by_digest is enabled by default from 3.3 onwards. This works on the

assumption that digests are preserved when images are copied between registries. Tools

such as crane copy and scope copy will do this, but the docker CLI does not necessarily

preserve digests.