In Docker Trusted Registry, how would a user prevent an image, for example 'nginx:latest' from being overwritten by another user with push access to the repository?

Simply tagging an image with a descriptive name like 'nginx:immutable' does not automatically confer immutability properties; it requires a registry-level configuration.

Removing push access from all other users is too restrictive as it would prevent them from pushing any new tags or images to the repository.

Docker Trusted Registry (DTR) allows users to configure repositories to make specific image tags immutable via its web UI. Once a tag (e.g., 'nginx:latest') is marked immutable, no user, even with push access, can overwrite or delete the image associated with that tag, guaranteeing its integrity and preventing accidental or malicious changes.

Keeping a backup copy of the image on another repository is a good backup strategy but does not prevent the original tag from being overwritten on the source DTR repository.