we can pin specific docker image to use by tagging the commit SHA

build:
  stage: build
  image: docker@sha256:the_sha
  services:
    - docker:dind@sha256:the_sha