Actually, the correct and only way to find out if ":latest" breaks your image you create your image using ":latest"! How are you going to know if the latest ve

Actually, the correct and only way to find out if ":latest" breaks your image you create your image using ":latest"! How are you going to know if the latest version of the upstream image breaks your package if you don't try it? E whole point of continuous integration is that there are no surprises when it comes time to push to production. If ":latest" breaks your image you had better know: A) Immediately. B) What went wrong ASAP. The integrated testing (that you're supposed to use with Docker best practices) should reveal if there's a problem and if it doesn't you'll still catch it during QA testing of your image. The fact that ":latest" breaks your image should be nothing more than a few minutes to days of troubleshooting. While you're doing that your existing production images will keep on chugging away. The only rule that you must not break is that you have the next release of your image out the door, ready for production within 30 days. Why? Because that's the maximum (hard-coded) lifetime we (and you should too) allow images to stay running.