镜像标签可以移动，既有容器仍保留原先选择的镜像

from pathlib import Path
from tempfile import TemporaryDirectory
import json,subprocess,uuid

BASE='python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84'
def docker(*args,check=True):
    result=subprocess.run(['docker',*args],capture_output=True,text=True,timeout=120)
    if check:assert result.returncode==0,result.stderr
    return result
def inspect(name,kind='image'):return json.loads(docker(kind,'inspect',name).stdout)[0]

name='xbcatm-tags-'+uuid.uuid4().hex[:10];tags=[name+':one',name+':two',name+':release',name+':latest'];container=name+'-old'
try:
    with TemporaryDirectory(prefix=name+'-') as directory:
        root=Path(directory)
        (root/'Dockerfile').write_text(f'FROM {BASE}\nCOPY version.txt /version.txt\nCMD ["cat", "/version.txt"]\n')
        for tag,version in zip(tags,['one','two']):
            (root/'version.txt').write_text(version+'\n');docker('build','--network','none','-t',tag,str(root))
        one=inspect(tags[0])['Id'];two=inspect(tags[1])['Id'];assert one!=two
        docker('image','tag',tags[0],tags[2]);docker('image','tag',tags[0],name)
        assert inspect(tags[2])['Id']==inspect(tags[3])['Id']==one
        docker('create','--name',container,'--network','none',tags[2])
        docker('image','tag',tags[1],tags[2])
        assert inspect(tags[2])['Id']==two and inspect(tags[3])['Id']==one
        assert inspect(container,'container')['Image']==one
        assert docker('start','--attach',container).stdout.strip()=='one'
        assert docker('run','--rm','--network','none',tags[2]).stdout.strip()=='two'
        assert docker('run','--rm','--network','none',tags[3]).stdout.strip()=='one'
        print('moving release changes newly created containers; the existing container still runs its original image')
        print('omitting a tag selected latest, but updating release did not update latest')
        docker('image','rm',tags[2]);assert inspect(tags[1])['Id']==two
        print('removing one tag leaves another reference to the same image intact; all operations stayed local')
finally:
    docker('rm','-f',container,check=False);docker('image','rm',*tags,check=False)