GotchaDifficulty: Intermediate1 min

The latest Tag Is Not the Newest Image

Two machines pull the same name an hour apart and run different code, and neither did anything wrong.

latest is the tag Docker uses whenever a build, a push or a pull names no tag. It is only a default name: Docker never checks that the image it points at is the most recent one.

Two machines pull myorg/api:latest an hour apart and run different code. Neither pulled wrongly:

bash

docker pull myorg/api
Using default tag: latest
latest: Pulling from myorg/api

The pull used latest because the command named no tag, and latest points at whichever image was last pushed under that name. Nothing compares dates, so if someone pushed myorg/api:2.3 after the last push of latest, latest still points at the older image, or at an image that was never a release at all.

Name a real tag every time you build and every time you run: a version, a date or a commit. latest is worth keeping as an alias for the image you want people to get by accident, and worth nothing as a description of what an image contains.

← → move through sections and cards