Also, it’s best practise to specifically refer to the digest for containers to avoid re-tags resulting in different images. For folks who audit what runs on their infrastructure, digests are the standard way of referring to an image. For Immich, I’d presume that the digest is partially a security thing and partially a “this specific image is known to be working”.