Loading page
About this tool
Convert mutable image tags into pinned @sha256 digest references and scan Dockerfiles or manifests for unpinned images.
This helper converts a mutable container image tag like nginx:1.27 into an immutable digest reference like nginx:1.27@sha256:..., following the OCI distribution spec rule that a sha256 digest identifies exactly one manifest forever. It also scans Dockerfile FROM lines and image: keys in compose or Kubernetes manifests and reports which references are pinned, which ride mutable tags and which fall back to :latest. Built for DevOps and supply-chain-security work where reproducible deployments matter.
Open Container Image Digest Pinning Helper on AltFTool — it loads instantly in your browser.
Upload or drag in the file you want to work with.
Adjust the settings and preview the result.
Download the finished file to your device.
Checks the sha256: prefix and exactly 64 hex characters, catching truncated copy-pastes before they break a deploy.
Produces name:tag@digest so humans still see the version while the runtime resolves only the digest.
Classifies every image reference in pasted Dockerfiles and YAML as pinned, mutable tag or implicit :latest — multi-stage build aliases excluded.
It means referencing the image as name@sha256:<64-hex-digest> instead of name:tag, so the registry must return exactly one immutable manifest. Tags are mutable pointers that can silently move to new content; a digest is the SHA-256 hash of the manifest itself and can never point to anything else.
Run docker buildx imagetools inspect <image>, crane digest <image>, or docker images --digests for images you have pulled. For multi-architecture images, pin the digest of the top-level manifest list (what imagetools prints), not one platform's manifest, or other architectures will fail to pull.
Yes — the form nginx:1.27@sha256:... is valid, and the container runtime ignores the tag entirely once a digest is present. Keeping the tag is recommended purely for humans reading the manifest, since the digest alone says nothing about the version.
A pinned image never changes, so it also never picks up patched base-image rebuilds published under the same tag — you keep running the old bytes until you update the digest yourself. Teams solve this with automation such as Renovate or Dependabot, which watch the tag and open a PR bumping the digest when a new image is published.