Why :latest is a production anti-pattern
deployment determinism and reproducibility.
latest is mutable so pods run different code, rollbacks and pull policy break, and you should use immutable version tags or digests.
What's really being asked
This checks whether you understand image tag immutability and its impact on reproducible, auditable deployments.
The full answer
The latest tag is not special; it is simply the default tag and is fully mutable, so the same reference can point to different image content over time. In Kubernetes this means two nodes might run different code if they pulled at different moments, and rollbacks are unreliable because there is no distinct prior tag to return to. Kubernetes also sets imagePullPolicy to Always when the tag is latest but IfNotPresent for fixed tags, so caching behavior becomes inconsistent. The fix is immutable tags: semantic versions like 1.4.2, a build identifier, or a git SHA, and for maximum strictness pin by content digest with the at-sha256 form. This guarantees a Deployment spec always resolves to identical bytes, enabling clean rollbacks and audits.
The mistakes people make
Claiming latest always pulls the newest published image on every pod. Believing latest helps rollbacks. Thinking the tag itself is immutable. Ignoring imagePullPolicy interactions.
What usually comes next
How does imagePullPolicy change with latest? What does pinning by digest buy you? How do you trigger an update with immutable tags? How does this affect a registry retention policy?
A concrete example
A team ships app:latest. A node restarts a pod, pulls latest, and gets a newer build than its siblings, causing inconsistent behavior under load. Switching to app:1.4.2 makes each Deployment revision explicit; a bad release is rolled back instantly by reverting to app:1.4.1, and for compliance the manifest pins app@sha256:abc..., so every cluster runs byte-identical images regardless of when they pulled.
Interview question
What is the core problem with deploying app:latest to production Kubernetes?
- a.Kubernetes cannot pull images tagged latest
- b.latest images are always larger on disk
- c.latest disables health checks
- d.The tag is mutable, so the same reference can resolve to different code across pods and timeCorrect
Why? this is the answer
latest is a movable pointer, breaking reproducibility and rollbacks. It is not blocked by Kubernetes (A), unrelated to size (B), and does not affect health checks (C).
Just read this? Test yourself on what you have been reading.
Read the original → kubernetes.io
- #kubernetes
- #image-tags
- #deployment
- #reproducibility
- #best-practices
Put your scrolling time to good use
Learn one idea, try a quiz and save useful cards for revision. Tezvyn makes it easy to learn and stay current in your tech field, a few minutes at a time.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.
We are hiring for this. Open roles that interview on kubernetes — each one lists the topics its interview covers.
See open roles