A floating tag is a Docker image tag that does not point to one fixed image forever. Instead, the maintainer moves it to a newer image when they publish one. Examples are latest, which usually follows the newest release, and tags that name a version series, such as one for a PHP minor version with a particular variant. The exact behavior depends on how each maintainer manages their tags.
Floating tags are convenient because rebuilding or pulling again can bring in updates, including security fixes, without changing the Dockerfile. They also mean the same tag can refer to different software at different times, so two builds made on different days from the same line may contain different versions, and builds are harder to reproduce.
The tag moving does not update anything that is already running. A container keeps the software from the image it was created from, and a locally cached image may be older than the tag now points to. Whether a floating tag brings in a particular fix also depends on whether the maintainer has published an image containing it and moved the tag, so the tag name alone is not proof that a system is patched.
To use floating tags safely, pull the image again and rebuild when you want updates, then redeploy and check the version actually running in the container. Where predictability matters, pin to an exact version or an image digest, and treat updating that pin as a regular maintenance task so it does not become stale.