October 2, 2026 路 #16
latest means something else today
Production restarted overnight and the bug you fixed last week came back. Which line explains it?
apiVersion: apps/v1
kind: Deployment
metadata:
name: api
spec:
template:
spec:
containers:
- name: api
image: ghcr.io/acme/api:latest
imagePullPolicy: AlwaysNext puzzle in UTC
One try. The first answer sticks.
How to fix it
latest is a moving pointer. Combined with imagePullPolicy Always, every restart can run a different build. Pin the image to a digest.
Tags move. latest moves whenever someone pushes, including a revert, a bad cache, or a publish from a branch you did not mean to ship. imagePullPolicy: Always then guarantees the kubelet goes and gets that new blob the next time the pod starts. A node reboot becomes a deploy.
Pinning to a version tag such as v1.4.2 is better and still not enough if the registry lets you overwrite tags. A digest cannot be overwritten.
Fix
image: ghcr.io/acme/api@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
imagePullPolicy: IfNotPresent
Change the digest in Git when you intend to roll out. Let Renovate open the pull request. IfNotPresent is safe once the reference is immutable, and it keeps a registry outage from blocking a reschedule.