What is an image digest, and how does it differ from a tag?

A digest (sha256:...) is a cryptographic hash of the image manifest, uniquely and immutably identifying exact content. A tag (like `latest` or `1.2.0`) is a mutable, human-friendly pointer that can be reassigned to point at different digests over time — pulling by digest guarantees you get exactly the same bytes every time.