Secure container images for open source software
“So pin to a digest. you'll say latest at and then a sha. And that will mean this specific version of that image. And then you'll use something like renovate or dependibot to update. so that's the way I would do things.”