Explanation
Passing the '-insecure-registry' flag to the daemon at run time is a way to configure the Docker engine to use a registry without a trusted TLS certificate. According to the official documentation, this flag allows access to registries that have invalid or self-signed certificates.
References: https://docs.docker.com/registry/insecure/

Tagging the image with 'nginx:immutable' is not how a user can prevent an image, such as 'nginx:latest', from being overwritten by another user with push access to the repository.Tagging the image with 'nginx:immutable' will only create a new tag for the image, but it will not prevent the original tag from being overwritten. To prevent an image tag from being overwritten in Docker Trusted Registry, the user can use the DTR web UI to make the tag immutable1. This will prevent anyone from pushing a new image with the same tag, even if they have push access to the repository1. Alternatively, the user can also use the DTR API to make the tag immutable2. Reference: Prevent tags from being overwritten), DTR API reference)

Explanation
Process ID is a type of Linux kernel namespace that provides container isolation. Process ID (pid) namespace isolates the process ID number space, which means that processes in different pid namespaces can have the same PID. This allows each container to have its own init process (PID 1), which is the first process to start in a container and the ancestor of all other processes in the container. Pid namespace also prevents processes in one container from seeing or signaling processes in another container or on the host system, unless they share the same pid namespace or have the CAP_SYS_PTRACE capability. References:
https://docs.docker.com/engine/reference/run/#pid-settings-pid,
https://en.wikipedia.org/wiki/Linux_namespaces#Process_ID_(pid)

Explanation
Using docker container inspect nginx does display a list of volumes for a specific container. The docker container inspect command shows low-level information about one or more containers in JSON format. This information includes various details about the container's configuration, state, network settings, mounts, etc.
To display a list of volumes for a specific container, you can either look at the Mounts section in the JSON output or use --format '{{ .Mounts }}' to filter out only that section. References:
https://docs.docker.com/engine/reference/commandline/container_inspect/,
https://docs.docker.com/engine/reference/commandline/container_inspect/#format-the-output