Skip to content

Please keep released Docker image tags immutable #1177

Description

@MaxRink

We found that netapp/trident-operator:26.06.1 was published with two different image digests.

Our mirror first stored:

sha256:3e458f02d42743977e4e845ca76a37d5896f0277ffc13953316c981dbf2d3c4f

Later Docker Hub served:

sha256:5e8ba78f4ab1371b6a4f57c4af297ed0708059c284a92b252ebb57995c1894c9

Our first mirror job succeeded. A later downstream job failed because our OCI mirror correctly refused to overwrite the existing tag. This blocked CI and downstream image updates.

Please do not republish a released image tag with different content. If the image must change, please publish a new tag and document the change. Reusing a tag breaks reproducible builds, digest checks, caches, and mirror consistency. It also makes rollback and incident analysis harder. In this case the Git tag still pointed to the same commit, so the image change was not visible from the source tag.

Can you confirm whether 26.06.1 was republished intentionally and document the final image digest?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions