Why is using the latest tag in production considered a bad practice?
latest is a moving target, so deployments are not reproducible. You cannot tell which version runs, rollbacks are unclear, and nodes may pull different images at different times. Use explicit version or digest tags.
Explain it simply
Writing 'bring the latest notes' to your friend means different notes each day. Tomorrow's exam preparation depends on what 'latest' meant that morning.
With myapp:latest, you cannot say which code is live, and rolling back means 'the previous latest', which no longer exists as a name. Two Kubernetes nodes may hold different copies of latest, because the default pull policy only pulls when the image is absent, so half your pods run old code. Debugging becomes guesswork. In Kubernetes, latest (or no tag) also sets imagePullPolicy: Always, causing extra pulls.
Tag every build uniquely, such as myapp:1.4.2 or the Git commit short SHA, deploy that exact tag, and keep a record of what is live. Rolling back is then just deploying the old tag.
Example
# avoid
image: myapp:latest
# prefer
image: myapp:1.4.2
# or
image: myapp@sha256:0123456789abcdef...What to say in the interview
"latest changes over time, so deployments are not reproducible, nodes can disagree, and rollback has no clear target. I deploy immutable version or commit-SHA tags, or digests."
Common mistakes
- Pushing both :1.4.2 and :latest and then deploying :latest.