From 854522dfb00151c4bf4e5b1da8a91ac8e8a1bf7b Mon Sep 17 00:00:00 2001 From: Brad Davidson Date: Thu, 29 Feb 2024 19:45:21 +0000 Subject: [PATCH] Add note about latest tag Signed-off-by: Brad Davidson --- docs/installation/registry-mirror.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/docs/installation/registry-mirror.md b/docs/installation/registry-mirror.md index ce2953c9c..772e7e203 100644 --- a/docs/installation/registry-mirror.md +++ b/docs/installation/registry-mirror.md @@ -78,6 +78,17 @@ mirrors: - https://mirror.example.com ``` +### Latest Tag + +When no tag is specified for a container image, the implicit default tag is `latest`. This tag is frequently +updated to point at the most recent version of the image. Because this tag will point at a different revisions +of an image depending on when it is pulled, the distributed registry **will not** pull the `latest` tag from +other nodes. This forces containerd go out to an upstream registry or registry mirror to ensure a consistent +view of what the `latest` tag refers to. + +This aligns with the [special `imagePullPolicy` defaulting](https://kubernetes.io/docs/concepts/containers/images/#imagepullpolicy-defaulting) +observed by Kubernetes when using the `latest` tag for a container image. + ## Security ### Authentication