[zoobab]

Actually, if you use the SHA256 of the image as a reference for the FROM (ex: tomcat@sha256:c34ce3c1fcc0c7431e1392cc3abd0dfe2192ffea1898d5250f199d3ac8d8720f), and if there is no tag associated to that SHA, there is a chance that the Docker Registry will garbage clean it. The Docker Inc garbage cleaning frequency is not very documented.

[manishyt]

Hello, I am one of the engineers on Docker Hub. If the image was ever pushed via a tag which must be the case if it was done via docker CLI then that image is never deleted (unless the tag is deleted from Hub UI and no other tag refer to it). This means if sha256:c34ce3c1fcc0c7431e1392cc3abd0dfe2192ffea1898d5250f199d3ac8d8720f was referred by latest tag which was pushed to another image sometime later then `FROM tomcat@sha256:c34ce3c1fcc0c7431e1392cc3abd0dfe2192ffea1898d5250f199d3ac8d8720f` will continue to work. Apologies for not having this documented. I'll work on getting this documented on https://docs.docker.com/docker-hub/.

[rickycook]

there is no other behaviour that you’d want for that situation though... garbage collection is necessary, and if your cryptographically pinned content is deleted, you want something to fail rather than change to different content