True image pinning means locking to an image digest in the form of FROM ubuntu@sha256:..., to ensure that exactly the same binary layers are pulled at any time and place.