-1

We've been discussing tagging strategies for our docker ECR repos and what we've landed on doesn't involve use of the latest tag at all.

I know latest isn't anything automatic. It's just a regular tag. But it's also a convention. Is it expected that latest exists? Are there tooling problems or things that may break if our repos don't have it at all?

xdhmoore
  • 8,935
  • 11
  • 47
  • 90
  • 1
    Nothing really will break except docker pull (without a tag) will return an error since it defaults to the ‘latest’ tag. As long as you always pull with a tag, everything will work just fine – camba1 May 12 '20 at 23:27

1 Answers1

2

You should be fine without the latest tag - there should be no tooling problems as long as you are using other tags and / or sha256 digests explicitly for pulling images.

That said, usually there is no good reason to avoid latest tag completely. Conventional approach is to push your latest acceptable build to its own tag AND the latest tag. It is hard to find an argument against this approach, since using latest is convenient in many non-scripted cases (i.e., a developer pulling the image locally and just using latest) - and at the same time you get this image with its proper tag.

Final thing I want to mention - since tags may be mutable, scripted pipelines and especially production instances should use explicit sha256 digests when pulling images.

taleodor
  • 1,849
  • 1
  • 13
  • 15