Shameless Plug: I wrote a cli-plugin for docker, docker-lock, that will track the image digests (SHA's) of your images in a separate file that you can check in to git, so you will always know exactly which image you are using (even if you are using the latest tag). It can even rewrite all your Dockerfiles and docker-compose files to use those digests.

https://github.com/safe-waters/docker-lock

Would love for anyone dealing with this issue to check it out!