Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Just say no to :latest

platformers.dev

Post reply on HN
Print view View original

1–10 of 135 posts

Re: Just say no to :latest

#3

Post by fuzzy2 »

keymone wrote: post #2

# GOOD: image: "nginx:1.21.6" nothing "good" about it, literally no different from ":latest". only full hash reference.

Sure version tags could also move, but by convention they do not. Unlike the latest tag, which by convention does move a lot.

Re: Just say no to :latest

#4

Post by delusional »

keymone wrote: post #2

# GOOD: image: "nginx:1.21.6" nothing "good" about it, literally no different from ":latest". only full hash reference.

From the original article

> This brings up an interesting side point, in that Docker Hub and most other registries allow mutable tags by default. So nginx:1.21.6 might not be the same image today as it was yesterday. In reality, you probably need a mechanism to enforce tag immutability: e.g., your own registry mirror, or referring to images by SHA)

Re: Just say no to :latest

#5

Post by keymone »

delusional wrote: post #4
keymone wrote: post #2

# GOOD: image: "nginx:1.21.6" nothing "good" about it, literally no different from ":latest". only full hash reference.

From the original article > This brings up an interesting side point, in that Docker Hub and most other registries allow mutable tags by default. So nginx:1.21.6 might not be the same image today as it was yesterday. In reality, you probably need a mechanism to enforce tag immutability: e.g., your own registry mirror, or referring to images by SHA)

yeah, well, i stopped reading when i saw that "GOOD" example. it's not. and that isn't a "side point", that's the most critical point for preserving security and reproducibility of builds.

Re: Just say no to :latest

#7

Post by saulr »

Worth noting that Hadolint[1] raises warnings the issues mentioned in the article. Some examples of warnings:

- https://github.com/hadolint/hadolint/wiki/DL3007: Using latest is prone to errors if the image will ever update. Pin the version explicitly to a release tag. - https://github.com/hadolint/hadolint/wiki/DL3013: Pin versions in pip. - https://github.com/hadolint/hadolint/wiki/DL3018: Pin versions in apk add.

[1] https://github.com/hadolint/hadolint

Re: Just say no to :latest

#9

Post by oxfordmale »

This is always a balance. The moment you pin to a specific version you need to have a process in place to ensure you regularly upgrade to avoid introducing vulnerabilities in your production system. Throughout my career I have seen many cases where certain software still runs on ancient versions as the team originally maintaining it is no longer around (e.g. reorganisations or lay-offs). It is always hard to convince senior management to invest any resources to upgrade (If it works don't fix it)

If I have project that has good unit test coverage, I prefer to use :latest, as this results in a gradual update over time. If something breaks due to a version discrepancy, it is a lot easier to convince management to fix this, as the breakage would only be noticed as part of a feature request, and often would only require a small amount of work.

Post reply on HN