title: Docker downloads newer image for supposedly-cached digest
body: <p>My <code>Dockerfile</code> has this first step:</p>
  
  <pre><code>FROM python:3.6.10@sha256:6cd232ed00e729b4d4d3aa57c1764dddfab70f616042b7f36536e2c3d70c4c11
  </code></pre>
  
  <p>The goal of this is <a href="https://docs.docker.com/engine/reference/commandline/pull/#pull-an-image-by-digest-immutable-identifier" rel="nofollow noreferrer">to "lock" or "pin" the version of the image</a>.</p>
  
  <p>For a while, <code>docker build</code> correctly used the cached version:</p>
  
  <pre><code>Step 1/2 : FROM python:3.6.10@sha256:6cd232ed00e729b4d4d3aa57c1764dddfab70f616042b7f36536e2c3d70c4c11
   ---&gt; 114ae8bdb954
  </code></pre>
  
  <p>But after some time, it decided to "download a newer image":</p>
  
  <pre><code>Step 1/2 : FROM python:3.6.10@sha256:6cd232ed00e729b4d4d3aa57c1764dddfab70f616042b7f36536e2c3d70c4c11
  sha256:6cd232ed00e729b4d4d3aa57c1764dddfab70f616042b7f36536e2c3d70c4c11: Pulling from library/python
  7e2b2a5af8f6: Pulling fs layer
  09b6f03ffac4: Pulling fs layer
  dc3f0c679f0f: Pulling fs layer
  fd4b47407fc3: Pulling fs layer
  bb7b28578995: Pulling fs layer
  6ebea4a9a306: Pulling fs layer
  22a2327cd1ca: Pulling fs layer
  bfbf91c84bbe: Pulling fs layer
  f6b29b259c5c: Pulling fs layer
  09b6f03ffac4: Verifying Checksum
  09b6f03ffac4: Download complete
  dc3f0c679f0f: Download complete
  7e2b2a5af8f6: Verifying Checksum
  7e2b2a5af8f6: Download complete
  6ebea4a9a306: Verifying Checksum
  6ebea4a9a306: Download complete
  fd4b47407fc3: Verifying Checksum
  fd4b47407fc3: Download complete
  bfbf91c84bbe: Verifying Checksum
  bfbf91c84bbe: Download complete
  f6b29b259c5c: Verifying Checksum
  f6b29b259c5c: Download complete
  22a2327cd1ca: Verifying Checksum
  22a2327cd1ca: Download complete
  bb7b28578995: Verifying Checksum
  bb7b28578995: Download complete
  7e2b2a5af8f6: Pull complete
  09b6f03ffac4: Pull complete
  dc3f0c679f0f: Pull complete
  fd4b47407fc3: Pull complete
  bb7b28578995: Pull complete
  6ebea4a9a306: Pull complete
  22a2327cd1ca: Pull complete
  bfbf91c84bbe: Pull complete
  f6b29b259c5c: Pull complete
  Digest: sha256:6cd232ed00e729b4d4d3aa57c1764dddfab70f616042b7f36536e2c3d70c4c11
  Status: Downloaded newer image for python@sha256:6cd232ed00e729b4d4d3aa57c1764dddfab70f616042b7f36536e2c3d70c4c11
   ---&gt; 114ae8bdb954
  </code></pre>
  
  <p>even though the final hash of this step is identical:</p>
  
  <pre><code> ---&gt; 114ae8bdb954
  </code></pre>
  
  <p>As I understand, digests (<code>sha256:...</code>) are immutable.<br>
  So are they mutable after all?<br>
  Or was the cached version somehow deleted?<br>
  What's going on and how do I fix it?</p>