broke2026-08-08draft
The latest tag that never updated
Every deploy said it succeeded and every deploy served the old build.
docker compose up -d pulls only if the tag is missing locally. :latest is a mutable tag,
and the host already had one cached from an earlier deploy, so every subsequent deploy reused
it forever regardless of what was on the registry. A manual docker pull on the box fetched
the correct digest instantly, which is how I found it.
pull_policy: always on both services. It has been there ever since, with a comment long
enough that I will not remove it by accident.