Also, it’s best practise to specifically refer to the digest for containers to avoid re-tags resulting in different images. For folks who audit what runs on their infrastructure, digests are the standard way of referring to an image. For Immich, I’d presume that the digest is partially a security thing and partially a “this specific image is known to be working”.

I don’t see how GnuPG can be acquired

For the record, you should probably use a lower-case ‘k’ (as in kilo, the SI prefix) rather than an upper case K (the unit of temperature, Kelvin), both in general and especially when referring to temperatures!