One thing that I find really useful is when packages also publish semver tags. So when pushing version 1.2.3 you would push to `my-image:latest`, `my-image:1`, `my-image:1.2` and `my-image:1.2.3`. That way, when consuming the image, you can decide whether to pin to a specific version, or whether just to pin the major version and accept the latest minor/patch version within it.

I’m actually working on a tool to make this easier, along with also generating change logs, called “Rolling Versions”. If you’d like to know when it’s released, you can sign up to my mailing list