[sneak]

Docker tags (imagename:tag) aren't cryptographically secure and can be replaced by the server at any time if you aren't using imagename@sha256:<hash> format.