World D5: Ship & Shield

No latest in production

You will learn: to tag images so you always know what is running.

Checked with Docker Engine 29 on 31 Oct 2026

The problem

Production ran kedai-api:latest all week. Nobody touched production. So why did it break on Friday? Tap each day.

Tap each point on the timeline.

Watch

~/kedai-api $ echo "// v2" >> server.js~/kedai-api $ docker build -t kedai-api:latest .[+] Building 0.1s (8/8) FINISHED                                  docker:default => [internal] load build definition from Dockerfile                        0.0s => => transferring dockerfile: 149B                                        0.0s => [internal] load metadata for docker.io/library/node:24-alpine           0.0s => [internal] load .dockerignore                                           0.0s => => transferring context: 2B                                             0.0s => [1/3] FROM docker.io/library/node:24-alpine@sha256:8a32c8cf649a49915a6  0.0s => => resolve docker.io/library/node:24-alpine@sha256:8a32c8cf649a49915a6  0.0s => CACHED [2/3] WORKDIR /app                                               0.0s => [internal] load build context                                           0.0s => => transferring context: 391B                                           0.0s => [3/3] COPY package.json server.js ./                                    0.0s => exporting to image                                                      0.1s => => exporting layers                                                     0.0s => => exporting manifest sha256:1b34738bad13a442ec159a4f0a04e2f002e402b39  0.0s => => exporting config sha256:ca6709ac73d926dae9701eee68c5b97db0b8765ee69  0.0s => => exporting attestation manifest sha256:c78f718a781506e08d3f0c178186a  0.0s => => exporting manifest list sha256:74d50ecfc044c78caf5df7ae46587d54748c  0.0s => => naming to docker.io/library/kedai-api:latest                         0.0s => => unpacking to docker.io/library/kedai-api:latest                      0.0s~/kedai-api $ docker images                                               i Info →   U  In UseIMAGE              ID             DISK USAGE   CONTENT SIZE   EXTRA<untagged>         2129fa8649fa        244MB         62.5MB        kedai-api:latest   74d50ecfc044        244MB         62.5MB        node:24-alpine     8a32c8cf649a        244MB         62.8MB

Your laptop`~/kedai-api`

No open hatches

Lunchboxes (containers)

No containers yet

Frozen packs (images)

kedai-api:latest6 layers · 244MB
node:24-alpine4 layers · 244MB

latest is just a label name. It does not mean newest or tested. A moves to whatever you built last.

Try it

Good tag for production? Swipe right for yes.

Swipe right for good, left for needs work. Or use the buttons.

1 / 5kedai-api:1.4.2

Try it

Give one build two good tags: the version and the Git commit. One docker build takes two -t flags.

Your laptop`~/kedai-api`

No open hatches

Lunchboxes (containers)

No containers yet

Frozen packs (images)

kedai-api:latest6 layers · 244MB
node:24-alpine4 layers · 244MB

Hint

docker build -t kedai-api:1.4.2 -t kedai-api:sha-3f9c2e1 . The dot means “this folder”.

Predict

kedai-api:1.4.2 is in production. You fix a typo. Which tag does the fix get?

You did it!

You can now tag images so production always knows what it runs.

Go deeper (optional)

Many teams also push moving tags like 1.4 and 1, for people who want updates. Production should still name the full version, or a digest (next lesson). In CI, docker/metadata-action makes these tags from your Git tags (Part 2, World C2).

Real rep (optional), in a folder with a Dockerfile and at least one Git commit:

Real mission

Build once with a version tag and a commit tag.
docker build -t practice:1.0.0 -t practice:sha-$(git rev-parse --short HEAD) .
Both tags show the same image ID.
docker images practice

0 of 2 steps done · Your ticks are saved.

No latest in production

Your laptop~/kedai-api

Lunchboxes (containers)

Frozen packs (images)

Your laptop~/kedai-api

Lunchboxes (containers)

Frozen packs (images)

Your laptop`~/kedai-api`

Your laptop`~/kedai-api`