Unique tagging simply means that every image pushed to a registry has a unique tag. If your container restarts or an orchestrator scales out more instances, your hosts won’t accidentally pull a newer version, inconsistent with the other nodes. You likely want deliberate deployments of a consistent version of components. Recommendation: Use unique tags for deployments, especially in an environment that could scale on multiple nodes. For example, auto-purge untagged manifests older than a specified duration, or set a retention policy for untagged manifests. To maintain your registry size, you can periodically delete untagged manifests resulting from stable image updates. The previous image's manifest and unique layer data remain in the registry. If an image with a stable tag is updated, the previously tagged image is untagged, resulting in an orphaned image. From a base image scenario, this allows the image owner to provide serviced images. In this case, both the major and minor tags are continually being serviced. When base image updates are available, or any type of servicing release of the framework, images with the stable tags are updated to the newest digest that represents the most current stable release of that version. The team also uses the :latest tag, which points to the latest stable tag, no matter what the current major version is. :1.0- a stable tag for version 1.0, allowing a developer to bind to updates of 1.0, and not be rolled forward to 1.1 when it is released.1 represents the “newest” or “latest” 1.* version. :1 – a stable tag for the major version.To support stable tags for a given major and minor version, they have two sets of stable tags. They know they’ll ship updates, including minor updates. ExampleĪ framework team ships version 1.0. To stay “stable”, it might be serviced to apply security patches or framework updates. Rather, stable implies the image should be stable for the intent of that version. Stable doesn’t mean the contents are frozen. Stable tags mean a developer, or a build system, can continue to pull a specific tag, which continues to get updates. Avoid deployments with stable tags, because those tags continue to receive updates and can introduce inconsistencies in production environments. Recommendation: Use stable tags to maintain base images for your container builds. Unique tags - A different tag for each image you push to a registry, such as mycontainerimage:abc123.Stable tags - Tags that you reuse, for example, to indicate a major or minor version such as mycontainerimage:1.0.This article discusses two approaches and where each fits during the container lifecycle: When pushing container images to a container registry and then deploying them, you need a strategy for image tagging and versioning.

Final draft tagger number id