Using the latest tag

By default, the Docker CLI assumes a special tag called latest. This means that if you perform the docker pull applicationimage command or the docker run -it applicationimage command, or use FROM applicationimage in your Dockerfile, the applicationimage:latest tag will be used. Similarly, when you execute docker build -t applicationimage ., the resulting Docker image will be tagged with the latest tag and each subsequent build will produce a new version of applicationimage:latest.

It is important to understand that latest behaves just like any other Docker image tag. It can be seen as a default value that is always used by Docker whenever no tag has been provided by user. This has some consequences that may cause confusion, as follows:

• During an image build, if you specify your tag for the image, the latest tag will not be added. This means that if you push applicationimage:v1 to the registry, it doesn't mean that applicationimage:latest will be updated. You have to perform it explicitly.
• When the image owner pushes a new Docker image version to the repository and it is tagged again with the latest tag, this doesn't mean that your locally cached image will be updated and used during docker build. You have to tell the Docker CLI to attempt to pull a newer version of the image by using the --pull argument for docker build.
• Using the latest tag for the Dockerfile's FROM instruction can lead to different images being built in different points in time, which is generally not desirable. For example, you may be building your image using the mcr.microsoft.com/dotnet/core/sdk image at a point in time when latest points to version 2.2 of the SDK, but after a few months, building the same Dockerfile will result in version 3.0 being used as the base.

The general best practice (this is also the same for Kubernetes) is to avoid deploying production containers using the latest tag and use the latest tag just for development scenarios and ease of use for your local environment. Similarly, to ensure that your Docker images are predictable and self-descriptive, you should avoid using base images with the latest tag in a Dockerfile – use a specific tag instead.