Pin all container image tags — eliminate :latest #30

New issue

Open

opened 2026-07-25 19:37:16 +00:00 by lab · 0 comments

lab commented

2026-07-25 19:37:16 +00:00

Owner

Images pinned to :latest can break silently on upstream changes. Pin every image to a specific version.

Known :latest images (check running pods for actual versions)

Service	Image	Current
paperless-ngx	ghcr.io/paperless-ngx/paperless-ngx	:latest (being removed)
tailscale	tailscale/tailscale	:latest
homarr	homarr/homarr	:latest
caddy	ghcr.io/serfriz/caddy-cloudflare-crowdsec	:latest (no tag)
media stack apps	lscr.io/linuxserver/*	:latest (check each)

Steps

kubectl get pods -A -o jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}: {.spec.containers[*].image}{"\n"}{end}' — get all running images with versions
Update each values.yaml or manifest with the pinned version
Commit and verify deployments still work

Images pinned to `:latest` can break silently on upstream changes. Pin every image to a specific version. ## Known :latest images (check running pods for actual versions) | Service | Image | Current | |---------|-------|---------| | paperless-ngx | ghcr.io/paperless-ngx/paperless-ngx | :latest (being removed) | | tailscale | tailscale/tailscale | :latest | | homarr | homarr/homarr | :latest | | caddy | ghcr.io/serfriz/caddy-cloudflare-crowdsec | :latest (no tag) | | media stack apps | lscr.io/linuxserver/* | :latest (check each) | ## Steps 1. `kubectl get pods -A -o jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}: {.spec.containers[*].image}{"\n"}{end}'` — get all running images with versions 2. Update each `values.yaml` or manifest with the pinned version 3. Commit and verify deployments still work