:latest or :version for supporting services? reddit / selfhosted ---------------------------------------------------------------------- aRnonymousan · 2023-12-06 12:56 So for the past couple of years i've been running a bunch of services with docker, and my default is to just put :latest behind everything. But now the question is whether that's good practice, this question applies for all the "supporting" images: Redis, Postgres, etc. While the main app, often has new features and fixes, so i will more actively want to update it. Are there any real security risks to using an older version of postgres and updating maybe once a year? I feel like when a real vulnerabilities surface it is highlighted as big news. \*Bonus question, alpine version or not? ---------------------------------------------------------------------- WiseCookie69 · 2023-12-06 13:03 If you use latest, you'll end up breaking stuff. Especially with databases, or whenever there is a breaking change. Always use specific tags and have automations in place to notify you about updates (GitOps + Renovate is my favorite). And with your examples of Redis and Postgres there are always multiple supported major versions. So no need to hurry. ---------------------------------------------------------------------- Narrow_Letterhead_96 · 2023-12-06 13:04 For testing using :latest is fine, but for anything in production you should use a proper version number. There are probably several reasons for this but the two main ones for me are: - updates can break your setup and you want to be in control when they happen - depending on how you're running containers, the container image is cached locally based on the image name. So if you don't explicitly tell it to pull a newer image you might actually not be running the latest version at all ---------------------------------------------------------------------- Xiakit · 2023-12-06 13:18 I usually go with stable for almost everything and fixed versions for DBs. ---------------------------------------------------------------------- NiftyLogic · 2023-12-06 13:52 Since this is /r/selfhosted, I’m going with :latest for most of my services. Just more convenient and IMHO more secure since a timely update can fix a vulnerability I don’t even know about. Only exception is my DNS server, which could bring my whole network down. ---------------------------------------------------------------------- clintkev251 · 2023-12-06 13:55 Never latest. Using latest you're basically completely giving up control of your updates, so you may not have any idea when breaking changes could be introduced. At the very least you should pin to a major version, ideally pin to a minor version, but obviously that takes more work to keep on top of. I personally use Renovate and pin everything to a patch and digest, but that's probably overkill for most ---------------------------------------------------------------------- rumblpak · 2023-12-06 14:07 Always version in production. You never, ever, want to deploy unknown, untested code in production. In lower lifecycles, using latest is fine but be aware that in order to promote to production, you’re gonna want to test a tagged version. ---------------------------------------------------------------------- Vezajin2 · 2023-12-06 14:15 When I'm testing and doing initial setup, I use latest. Once it works and I've decided to keep the service, I switch to the version tag, because otherwise I'll forget what version I'm actually running, and checking for breaking changes when updating later become a huge pain. ---------------------------------------------------------------------- from-nibly · 2023-12-06 14:22 Not only that but you aren't in control of when an update happens. You might not get an update until you reboot your containers. Power goes out and comes back, your server tries to boot up and everything is broken because it's all suddenly on new versions. ---------------------------------------------------------------------- SpongederpSquarefap · 2023-12-06 14:25 I live dangerously so I do latest for most things Just not DBs - never do that ---------------------------------------------------------------------- CactusBoyScout · 2023-12-06 14:36 I don't use :latest with my torrent client because a lot of trackers take time to approve new versions of clients. But yeah otherwise I just use :latest for convenience. ---------------------------------------------------------------------- StarfishPizza · 2023-12-06 14:40 I go with latest. If there’s a problem I’ll rollback, but it’s mostly just latest and left to it. ---------------------------------------------------------------------- CactusBoyScout · 2023-12-06 14:45 DBs meaning any service that uses a database? Or specific separate Docker containers that have databases? ---------------------------------------------------------------------- NiftyLogic · 2023-12-06 14:50 Same here for Portainer, where :latest has issues with my setup. Hope they fix it soon. ---------------------------------------------------------------------- EmmaSamms · 2023-12-06 15:05 :version, with renovate bot telling me when updates are available on my GH Repo, last thing I need is a breaking change and stuff breaks. ---------------------------------------------------------------------- ProbablePenguin · 2023-12-06 15:18 I lock to major versions for databases always. Had far too many things break because postgres or something updates and the main service only works with the previous major version. Redis is probably pretty safe with latest though. ---------------------------------------------------------------------- ProbablePenguin · 2023-12-06 15:18 The specific database image itself. ---------------------------------------------------------------------- AKAManaging · 2023-12-06 15:31 Oh my gosh, thank you. I'm in the process of moving everything from Windows to Linux, and one of the services I need to transfer is for a tracker. Thanks for mentioning this, I need to remember it when I get to that point. ---------------------------------------------------------------------- Karbust · 2023-12-06 15:32 On databases I use the major version, I have MySQL 8, PostgreSQL 14, MongoDB 7 and InfluxDB 1.8 (for LibreNMS, “normal” Influx is on latest). Portainer is always set to a static version. I also have 2 different PHP versions running, 7.4 and 8.1, and I barely upgrade them because I already installed stuff inside, should have made an image, but oh well, it is what it is. Vaultwarden is also on a fixed version, I don’t dare upgrade it mindlessly like I do with other containers. Gitlab is also on latest, and pretty much everything else, apart from a few containers on specific versions because I’m lazy to do the dedicated steps to upgrade them properly. ---------------------------------------------------------------------- Turtvaiz · 2023-12-06 15:32 > I don't use :latest with my torrent client because a lot of trackers take time to approve new versions of clients. I don't think that happens unless there's a huge update like Deluge v1 vs v2? ---------------------------------------------------------------------- alex2003super · 2023-12-06 15:33 Nah, MAM complains even about minor version mismatches when qBT updates ---------------------------------------------------------------------- CactusBoyScout · 2023-12-06 15:34 Depends on the tracker. I’m on PTP and they’re the most strict about this, although I believe they finally made some change to their rules to automatically allow smaller updates. But for a while it was an issue where you’d have to wait weeks for one of the site admins to personally review any new version. ---------------------------------------------------------------------- jovialfaction · 2023-12-06 15:43 I just pull latest. All the comments talking about "NEVER LATEST IN PRODUCTION" are overkill. This is just self hosted setup, it's fine if there's some downtime. Going with "latest" ensure I'm always up to date and it honestly very rarely break (and I run over 10 services). If it does break, I can work on fixing it or just roll back if I don't have the time. If I pin to a version, I have to remember to update on a regular cadence. If I take too long between updates, it's more likely to break because when services release breaking changes, they will often test and ensure a smooth transition from version 1 -> 2, but if you go version 1 -> 3, nothing is tested and it sometimes get into a bad state. ---------------------------------------------------------------------- root-node · 2023-12-06 16:00 What issues? Mine is stable with `:latest` ---------------------------------------------------------------------- NiftyLogic · 2023-12-06 16:02 Running Portainer on Nomad and the 2.19.x versions won't start on my system. Already have a ticket open, maybe someone will have a look. ---------------------------------------------------------------------- suddenlypenguins · 2023-12-06 16:05 The "latest" tag does not actually mean latest, it doesn’t mean anything...source: https://vsupalov.com/docker-latest-tag/ - "What's Wrong With The Docker :latest Tag?" ---------------------------------------------------------------------- pusillanimouslist · 2023-12-06 16:09 I ended up with version, for two reasons. 1) I don’t want unplanned major upgrades of stuff other people in my house use. 2) Constantly reusing the “latest” tag causes all kinds of annoying pod caching issues. When I was using latest I had to set K3S to always download containers, which resulted in very slow restarts. ---------------------------------------------------------------------- DarkCeptor44 · 2023-12-06 16:18 Honestly I've been thinking about swapping from NPM to Caddy for a few weeks, I could just backup and spin up the new NPM image but might as well swap now. ---------------------------------------------------------------------- Wheels35 · 2023-12-06 16:39 This is the second time I've seen this mentioned. Do you have a link to any resources, or what I should search, to get more info on doing this? ---------------------------------------------------------------------- CactusBoyScout · 2023-12-06 17:00 MAM is the pickiest tracker lol. They pause all of your torrents if you just access the site from a different IP. Out of your house and wanna look up a book? Unless you use a VPN, you’ve just inadvertently stopped all your transfers. I don’t know any other tracker that does that. ---------------------------------------------------------------------- literal_garbage_man · 2023-12-06 17:12 You’re going to kick yourself if you use :latest. It’s going to break something eventually. Probably at an inopportune time. If the image has major or minor pins (e.g. redis:7 or redis:7.2, etc) you could do that instead of a full major.minor.patch pin. But even then I would recommend version pinning to a specific version. Especially if you’re someone who uses something like watchtower to auto-update images. Wouldn’t recommend it though. Try using :latest for a year and see how it works out lol ---------------------------------------------------------------------- we_swarm · 2023-12-06 17:15 I do both! I tag my services with :latest, then use [docker- lock](https://github.com/safe-waters/docker-lock). It scans your docker and docker-compose, generates a lock file and adds the current sha to git. That lets me freely update because I can always go get the previous version from git, rollback, and pin the version for that specific container if there is a problem. It really is the best of both worlds. ---------------------------------------------------------------------- borg286 · 2023-12-06 17:43 If you have some kind of test/staging/non-prod environment and you promote from that to prod, it might be worth testing latest. One thing you can do with docker is run a container at a given SHA, like redis:3682hfhsks467363, and I believe you can extract that information from one ran with :latest. This you can have your staging environment do a pre-processing step where it pulls :latest, extracts the SHA then updates your configs with the hard-coded SHA. That way prod is running fixed versions, and you're trying out new stuff. Sadly this requires pretty good integration testing. ---------------------------------------------------------------------- Jonteponte71 · 2023-12-06 17:44 Latest because the default setting for ”What’s up docker” is enough to keep track of updates. If nor you need to get into the nitty-gritty of watchers and triggern and who has the time? :) ---------------------------------------------------------------------- LeftBus3319 · 2023-12-06 17:45 You commit your docker-compose.yml file(s) to a GitHub repo (don't commit secrets!!), then add the [Renovate App](https://github.com/apps/renovate) to your repo, merge the onboarding PR, then you'll get PRs when an image is updated. ---------------------------------------------------------------------- Wheels35 · 2023-12-06 17:58 The link to the app is what I was looking for thanks! I took a quick look earlier and didn't see how it would (easily) integrate with my repo, but I was just glancing. ---------------------------------------------------------------------- CringeSniffingDog · 2023-12-06 18:27 Never ever :latest unless it's a small scale low risk-of-data-loss low risk-of-exploitation platform. At which point, why even use latest to begin with? Use one version until you have to update for security reasons or for stability reasons. Requires you to be a bit more engaged, but you get the benefits from everything and the negatives of none ---------------------------------------------------------------------- isleepbad · 2023-12-06 18:29 I use the latest tag. But I wrote my own program to alert me when there is an update. Then I save the sha256 and update only after I've read the change log for any breaking changes. ---------------------------------------------------------------------- One-Main5244 · 2023-12-06 18:35 For me it depends how critical the service is. For example my zitadel and nginx as well as my database containers I keep pinned for sure and first read the release notes since my version before upgrading those. Those are like the backbone the other stuff depends on so they need to keep running. Others I tend use latest, especially in the beginning when am trying them out etc might pin the version after a while if start to be depended on them like I did for vaultwarden which became a key service to me. ---------------------------------------------------------------------- adamshand · 2023-12-06 18:54 At home I use :latest for most things. For databases I'll use the major version number (eg. 13-alpine) so that I get non-breaking changes. I always use the alpine image if there is one. If I was running services professionally, I'd pin them to specific version. But honestly even in my homelab I think I've had one thing break because of a :latest tag and it took literally 30 seconds to rollback. Recently I've been experimenting with moving my homelab over to a Docker Swarm with CapRover. One of the little joys of CapRover is that rolling back to a previous version is literally two clicks. ---------------------------------------------------------------------- e3m88 · 2023-12-06 19:19 Expect stuff to break specially if you don't even monitor the changelogs. It doesn't happen often but it is what it is. ---------------------------------------------------------------------- ContributionDry2252 · 2023-12-06 19:29 We use :latest for the application images that we build in-house. For direct external images (databases etc), only pinned to specific versions. ---------------------------------------------------------------------- _Morlack · 2023-12-06 19:44 Are just spawn a service for testing? Then it is fine use latest just to try. But then when you want to host the service, you must pin the version. If a semVer is not available, you can also pin the sha of the image. ---------------------------------------------------------------------- ZeeroMX · 2023-12-06 20:03 Wow, so many people use their self hosting gear for production workloads. I only use it for labbing and entertainment, so jellyfin and others can fail without any trouble to me or my house. ---------------------------------------------------------------------- Fungled · 2023-12-06 20:28 I use :latest combined with pyouroboros on a cron job. I like to live on the edge But srsly, you can do this, but make sure you keep an eye on things that are particularly critical, e.g. making sure things like backups keep working ---------------------------------------------------------------------- electronicoldmen · 2023-12-06 22:56 You could simply use Renovate to automate creation of PRs for version updates. If you're taking a GitOps approach (you should be) then merging the PR will perforn the upgrade. You can even automerge PRs based on your comfort level - for example, only auto-merging patch versions. ---------------------------------------------------------------------- TwoBoolean · 2023-12-06 23:47 I just moved from Nginx Proxy Manager to the Kubernetes Caddy Ingress, it’s been a great experience thus far, especially with Automatic SSL. ---------------------------------------------------------------------- bamhm182 · 2023-12-07 00:11 I too have learned this lesson the hard way! ---------------------------------------------------------------------- MentalDV8 · 2023-12-07 02:40 :latest in my DEV, the :version that turned out to work fine there into my TEST and then once that passes test, that same :version into PRODuction. I treat any operating system the same way. I put the exact version into DEV as a VM of course and test with my changes, then I move that into TEST and give it a rigorous test to ensure it's not going to break under some stress. Then it goes to PROD. Alpine is at 3.18.4 PROD and 3.18.5 TEST & DEV. I use extended, mini root, virtual, xen (a lot!), net boot, and the Raspberry Pi. Using the smaller images when I really must have it in a Docker container is a plus. ---------------------------------------------------------------------- mscreations82 · 2023-12-07 03:22 PostgreSQL is one that comes to mind for me. Killed my whole network because I use Authentik for authentication. Watchtower updated my postgresql version to a new major version which killed my setup for a few hours due to the incompatible version numbers. ---------------------------------------------------------------------- audero · 2023-12-07 03:27 Naughty. Breaking changes should only be in a major release. ---------------------------------------------------------------------- Charming-Molasses-22 · 2023-12-07 03:29 Every software is different but I use :latest on most of my services and update them automatically with watchtowers at night when am usually asleep. I keep track of the updates with a notification service I setup. If something is still broken in the morning, it's a good opportunity to get my hands dirty. Also, yes go with images based on Alpine. They cut the attack surface dramatically compared to other distro bases. ---------------------------------------------------------------------- labnerde · 2023-12-07 07:48 I do avoid :latest at all costs, I’m on business travels regularly and my homelab does control internet access at home. No need for family crying there’s no internet, when I can fix shit. With :latest you never know when your stuff is breaking. It could be days, weeks or even months after a breaking update. ---------------------------------------------------------------------- 2lach · 2023-12-07 07:57 For my stuff i go with the latest tag cause i don't really need to keep history if something breaks either it was my changes or i try the previous image that i was using to see if it fixes it. What i do for work stuff is different but essentially an easy solution. Every time i run a deployment i make two copies of the container being deployed. Copy 1 has the latest tag and will automatically replace the current latest in test/dev and on a different pipeline latest. Copy 2 has a version including date-buildid-gitsha So if something breaks in production its a matter of seconds to find the previous image i want to roll back to then i can find the issue and then when its solved just push the changes and where up and running again But this is way overkill for my homelab ---------------------------------------------------------------------- 2lach · 2023-12-07 07:59 And yes to alpine unless you wanna ssh into your container and do stuff then alpine and slim suck cause the have the worst pkg managers and builtin applications but if you just wanna run your app it doesn't get more lightweight ---------------------------------------------------------------------- AlexFullmoon · 2023-12-07 12:25 Frankly, a docker with good versioning is rarer than chance to break something with `latest` tag. What I mean is that ideally you run container with fixed major version tag, e.g. `postgres:15` and `requarks/wiki:2`. This both ensures you will receive security fixes and whatnot and you won't receive breaking changes. I run a couple containers like that, a couple with fixed version for specific reasons, and the rest are `latest`. ---------------------------------------------------------------------- phillibl · 2023-12-07 13:14 Always use latest so I get the most up to date features and security patches, except for databases use a pinned version for them. I use watchtower to notify me od updates but I manually update everything ---------------------------------------------------------------------- phillibl · 2023-12-07 13:37 I think a lot of people use the term production meaning, like essential/non testing. I've seen references to Plex and Sonarr 'In Production' lol. ---------------------------------------------------------------------- mrmclabber · 2023-12-07 17:31 latest unless it's a database or my monitoring stack. Been doing this for years and only had 1-2 times where there were breaking changes that required any real fix.