Why I Tag Container Images With the Commit SHA

For local testing I might build:

docker build -t hello-container:1.0.0 .

In CI/CD, I prefer an image tag derived from the Git commit.

GitLab provides:

CI_COMMIT_SHORT_SHA

So the pipeline can use:

docker build \
  -t "${IMAGE_NAME}:${CI_COMMIT_SHORT_SHA}" .

docker push \
  "${IMAGE_NAME}:${CI_COMMIT_SHORT_SHA}"

That creates a simple relationship:

Git commit
    │
    ▼
Pipeline
    │
    ▼
Container image

If the deployed image is:

hello-container:a1b2c3d4

I can identify the source revision that created it.

This is much clearer than repeatedly overwriting:

hello-container:latest

latest tells me almost nothing about provenance.

A commit-based tag gives me a useful deployment identifier without requiring the pipeline to invent another versioning system.