Why `latest` Is Not the Newest Image

Two machines pull myorg/api:latest an hour apart and run different code. Neither pulled wrongly.

bash

$ docker pull myorg/api
Using default tag: latest
latest: Pulling from myorg/api

latest is not a rule Docker enforces. It is the tag applied when nobody names one, on push and on pull alike, which makes it a default rather than a promise. Whatever was pushed with no tag most recently is what it points at — and that need not be the newest build, or a build at all.

Name a real tag every time you build and every time you run: a version, a date, a commit. latest is worth having as an alias for the one you want people to get by accident, and worth nothing as a description of what an image contains.

Docker
Containers