Describe use of sha256 hash with Wave

- https://github.com/seqeralabs/nf-tower-docs/issues/624

Author: jason-seqera

docs/guide.md docs/guide.mdxdocs/guide.md renamed to docs/guide.mdx

@@ -54,6 +54,26 @@ If an access token is not provided, the following rate limits apply:
 - 25 container builds per day
 - 250 container pulls per hour
 
+## Reproducible builds with SHA256 container image references
+
+Referring to the SHA256 hash of a container imagine is a common best practice in pipeline development. For example, the SHA256 hash for a container might be similar to `sha256:3235...ce8f`. If you use the Wave service to augment your containers, such as to add Fusion to a container, the original SHA256 hash of the image is no longer correct.
+
+To accommodate the new layers added to a container image augmented with Wave, you can use the freeze feature of Wave. In your pipeline configuration, ensure that you specify the following settings:
+
+```
+wave.enabled = true
+wave.freeze = true
+wave.strategy = ['dockerfile']
+wave.build.repository = 'docker.io/<user>/<repository>'
+```
+
+In your pipeline, you can use the SHA256 of the Wave augmented container, available in the target repository that you specify with the `wave.build.repository` parameter. For example:
+
+```
+docker.enabled = 'true'
+process.container = 'docker.io/<user>/my-bio-container@sha256:3235....ce8f'
+```
+
 ## Tutorials
 
 ### Authenticate private repositories