3.2.2.4 Git Commit Image Tags

Git commit image tags use the commit hash that produced a given build as the image's tag, tying every built image directly and unambiguously back to the exact source code state it came from, without needing a separately maintained version number.

Tagging Directly by Commit Hash

A build pipeline can tag the image it produces using the current commit hash, which is available automatically in most CI environments without any manual versioning decision needed.

docker build -t registry.example.com/myapp:$(git rev-parse --short HEAD) .
docker push registry.example.com/myapp:$(git rev-parse --short HEAD)

Every commit that triggers a build produces its own distinctly tagged image, with no risk of two different builds accidentally sharing the same tag.

Why Commit-Based Tagging Is Useful for Traceability

Given any deployed image, its commit-hash tag immediately reveals the exact source code it was built from, which can be checked out directly for debugging or auditing without needing to consult separate build logs or release notes.

git checkout a1b2c3d

Checking out the exact commit named by a deployed image's tag reconstructs precisely the source state that produced it.

Combining Commit Tags With Semantic Version Tags

Commit-based tags and semantic version tags are not mutually exclusive; a single build can be tagged both ways, giving consumers the choice between a precise, traceable reference and a more human-meaningful version number.

docker tag myapp:a1b2c3d myapp:2.3.1
docker push registry.example.com/myapp:a1b2c3d
docker push registry.example.com/myapp:2.3.1

Limitations of Commit-Based Tags Alone

Commit hashes are not meaningful to someone trying to understand the nature or significance of a change without additional context, which is why they are often used for internal traceability and CI/CD automation, while a separate, more human-readable versioning scheme is used for communicating releases externally.

git log --oneline a1b2c3d -1

Why Commit-Based Tagging Matters

Tagging by commit hash gives every build pipeline an automatic, collision-free, and perfectly traceable tagging scheme with no manual versioning decisions required, making it especially valuable for intermediate builds, pull request previews, and detailed debugging workflows.