Automatically updated rpm's may cause dependency issues

[aditya-konarde]

Here's the use case:

Lets say I have a container image named foo with tag 5.0

I have versioned the image according to my application. In the Dockerfile, I did a yum install bar which fetches the then-latest version for the package bar and the image is built.

Now that I have the image: as a user I expect it to be immutable and run the same everywhere, I perform some tests against the image, and mark it as all-set.

What happens next is - The rpm package bar is updated on one of the enabled repositories. This causes the container pipeline to rebuild the image. From an application perspective, this may cause dependency issues, and the changes in the image are not very apparent since the image tag remains the same.

Also, in case of OpenShift, if the image pull policy is not set to always, this may lead to several deployments using the older image, since the tag is not updated, and the nodes won't pull the image if its already available.

Not entirely sure how we can fix this, but one of the possibilities is minor-versioning the updated images.

Wdyt?