An image tag such as latest causes unclear rollbacks. What is the better practice?
Why D is the answer
Use a unique version tag for each build
Unique tags make each deployment traceable and reversible.
In detail
- A unique tag says exactly which build is running.
- Rollbacks then have a clear target.
- Use the commit hash as the tag.
Use case
An illustrative scenario, not a real incident.
Everything is tagged latest, so nobody knows what ran before a failure. Unique tags for each build make rollback exact.
See it in different ways
flowchart LR A["Source code"] --> B["ACR Tasks build"] B --> C["Azure Container Registry"] C --> D["App Service, Container Apps or AKS"]
sequenceDiagram participant U as Users participant I as Ingress participant A as Revision 1 participant B as Revision 2 U->>I: Requests I->>A: 90 percent I->>B: 10 percent
flowchart TD
Q{"Which tag?"}
Q -->|"latest"| A0["Unknown build"]
Q -->|"Unique version"| A1["Exact build"]Key point: Unique tags make rollbacks clear.
Why the other options are wrong
- A. Overwrite the same tag each time, so that deployments stay simple
- Overwriting a tag is the source of the problem.
- B. Delete all of the old images straight after each deployment
- Deleting old images removes your rollback path.
- C. Store the version number in a comment inside the Dockerfile only
- A comment does not identify a running image.