The reason for this is because Docker still doesn't have a lockfile like every (other?) dependency manager ever. Pinning a hash dooms you to use that hash forever, because there's no easy way to update under controlled circumstances.