theres no partial docker build afaik, so tagging sub-build shas like John says would be weird generally