What a Tag Actually Names

my-api:1 looks like a version number and behaves like a sticky label.

The image itself is identified by a hash of its content, which never changes and which nobody types. A tag is a name pointed at one of those hashes, and pointing it somewhere else is a single command that rewrites nothing.

bash

$ docker tag my-api:2 my-api:1
$ docker images my-api
REPOSITORY   TAG   IMAGE ID
my-api       1     3e9f77b21c04
my-api       2     3e9f77b21c04

Two tags, one image id. The image that my-api:1 used to name is still on the machine, now with no tag at all.

So a tag tells you what someone decided to call an image, and not what is inside it.

Docker
Containers