World D1: First Containers

Tags and the latest trap

You will learn: what a tag is, and why latest can surprise you.

Checked with Docker Engine 29 on 31 Oct 2026

The problem

Aina ran docker run nginx in January. Ben ran the same line today. They got different versions of nginx! How?

Watch

~ $ docker pull nginxUsing default tag: latestlatest: Pulling from library/nginx6fc242d221a6: Pull completea071113ac575: Pull complete9f604dae09b2: Pull complete6e2ab1f3ef4e: Pull completec139fe92686d: Pull completed322f1bf41d8: Pull completea670537bed70: Pull completeDigest: sha256:5ab5b0b01097420873a3f3330f44248e34a3c2a3e8d5ee30658aeae8cb7435daStatus: Downloaded newer image for nginx:latestdocker.io/library/nginx:latest~ $ docker images                                                i Info →   U  In UseIMAGE               ID             DISK USAGE   CONTENT SIZE   EXTRAalpine:3.22         2e0b81d60597       12.9MB         3.88MB        nginx:1.30-alpine   0e52bd054126       93.5MB           27MB        nginx:latest        5ab5b0b01097        243MB         66.8MB

Your laptop`~`

No open hatches

Lunchboxes (containers)

No containers yet

Frozen packs (images)

alpine:3.221 layers · 12.9MB
nginx:1.30-alpine8 layers · 93.5MB

A is the label after the colon, like 1.30-alpine. No tag? Docker says Using default tag: latest.

Try it

Which labels could suddenly give you a new version?

Drag a card into a box. Or tap the card, then tap the box.

Predict

Is always the newest, safest version?

Check

~ $ docker run -d --name pinned -p 8080:80 nginx:1.30-alpine2f1e4458ce8eeb100f4beb4a2a42307bc50f70777b97668cd744a843fd5270df~ $ docker run -d --name newest -p 8081:80 nginxUnable to find image 'nginx:latest' locallylatest: Pulling from library/nginx6fc242d221a6: Pull completea071113ac575: Pull complete9f604dae09b2: Pull complete6e2ab1f3ef4e: Pull completec139fe92686d: Pull completed322f1bf41d8: Pull completea670537bed70: Pull completeDigest: sha256:5ab5b0b01097420873a3f3330f44248e34a3c2a3e8d5ee30658aeae8cb7435daStatus: Downloaded newer image for nginx:latest5e58aeadbf439542332dc96b9b89c8c3cab36fa6762c85b2147fbed0479af324~ $ curl -sI localhost:8080 | grep ServerServer: nginx/1.30.6~ $ curl -sI localhost:8081 | grep ServerServer: nginx/1.31.8

Your laptop`~`

No open hatches

Lunchboxes (containers)

No containers yet

Frozen packs (images)

alpine:3.221 layers · 12.9MB
nginx:1.30-alpine8 layers · 93.5MB

Two boxes, both “nginx”. One answers 1.30.6, the other 1.31.8. You tested one, but production got the other. That is the latest trap.

Try it

Your turn. Run web from a pinned tag: nginx 1.30 on Alpine. No surprise jumps.

Your laptop`~`

No open hatches

Lunchboxes (containers)

No containers yet

Frozen packs (images)

alpine:3.221 layers · 12.9MB
nginx:1.30-alpine8 layers · 93.5MB

Check

~ $ docker pull nginx:9.9Error response from daemon: failed to resolve reference "docker.io/library/nginx:9.9": docker.io/library/nginx:9.9: not found

Your laptop`~`

No open hatches

Lunchboxes (containers)

No containers yet

Frozen packs (images)

alpine:3.221 layers · 12.9MB
nginx:1.30-alpine8 layers · 93.5MB

A tag that doesn’t exist? The real error ends with nginx:9.9: not found. Plain words: the freezer has no pack with that label.

You did it!

You can now pick tags on purpose and dodge the latest trap.

Go deeper (optional)

Even 1.30-alpine gets small fixes, so the pack can still change a little. To freeze one exact pack, use its digest: nginx@sha256:…. World D5 covers digests. One rule for now: never latest in production.

Real rep (optional):

Real mission

Pull a pinned tag.
docker pull nginx:1.30-alpine
See its tag in the list.
docker images nginx
Open hub.docker.com/_/nginx and find the Tags tab. Which tag is latest today?

0 of 3 steps done · Your ticks are saved.

Tags and the latest trap

Your laptop~

Lunchboxes (containers)

Frozen packs (images)

Your laptop~

Lunchboxes (containers)

Frozen packs (images)

Your laptop~

Lunchboxes (containers)

Frozen packs (images)

Your laptop~

Lunchboxes (containers)

Frozen packs (images)

Your laptop`~`

Your laptop`~`

Your laptop`~`

Your laptop`~`