A Docker image reference is not a string, it is a grammar. Five references that pass in your editor and fail at the daemon — and what the Docker Image Tag Validator catches that your build cache hides.
AES-256-GCM is the easy part. The bundle format around it — IV, auth tag, key derivation, version field — is where 90% of real-world encryption failures live. Here is what a good bundle looks like and why the JSON wrapper is the actual feature.