when build docker image, we need a base image. now base image is specified by tag. we can use sha256 to specify docker image.