Description

Currently, if one wants to ensure supply-chain security with regards to use of docker images in docker-compose files, users have to specify the digest manually in the compose file.

Previously there was a project (docker-lock) that could automate this, but this project has been deleted.

It would be great if docker-compose supported pinning images to digest, somewhat like npm lock-files, python lock-files and go sum-file.

If docker-compose could also support updating said images digest upon request, that would be great too, but that would not be necessary for a Minimal Viable Product version of the feature IMO, as long as i can request a "re-lock" from compose that updates the digests in the assumed new lock-file, when I have updated the tag in the compose-file