Disocurage use of untagged images

[solsson]

I'm investigating local build performance now. We tend to use :latest in test containers, but that slows builds down. In production containers we tend to use :[whatever version] but that's a false sense of stability as we learned from httpd:2.4.23 which had a config change within that tag that broke a downstream build.

This is just an idea but I felt build-contract would be a good place for a reminder about the value of :version@sha in FROM.