Your image has to travel from the build machine to the server. On the way it gets a name, a tag and a digest, and knowing which one to trust decides whether production runs what you tested.