Context
The ansible-reviewer suggested pinning container image versions for reproducibility and controlled upgrades.
Current State
All service definitions use :latest tags:
image: "lscr.io/linuxserver/radarr:latest"
Problem
:latest tags are mutable — the same tag can point to different images over time. This means:
- Deployments are not reproducible
podman auto-update may pull breaking changes- No easy rollback to a known-good version
- Different hosts may run different versions
Expected Behavior
Pin images to specific version tags or digests:
image: "lscr.io/linuxserver/radarr:5.x.x"
Use podman auto-update with --dry-run to check for updates, then manually update the version in the service definition and redeploy.
Files
services/*.yml — all service definitionsroles/immich/defaults/main.yml — Immich component versions
Notes
This is a trade-off between convenience (auto-updates with :latest) and stability (pinned versions). For a homelab, :latest with auto-update may be acceptable, but pinned versions are the safer practice. Consider making this configurable per-service.
From ansible-reviewer follow-up suggestion
Context
The ansible-reviewer suggested pinning container image versions for reproducibility and controlled upgrades.
Current State
All service definitions use
:latesttags:Problem
:latesttags are mutable — the same tag can point to different images over time. This means:podman auto-updatemay pull breaking changesExpected Behavior
Pin images to specific version tags or digests:
Use
podman auto-updatewith--dry-runto check for updates, then manually update the version in the service definition and redeploy.Files
services/*.yml— all service definitionsroles/immich/defaults/main.yml— Immich component versionsNotes
This is a trade-off between convenience (auto-updates with
:latest) and stability (pinned versions). For a homelab,:latestwithauto-updatemay be acceptable, but pinned versions are the safer practice. Consider making this configurable per-service.From ansible-reviewer follow-up suggestion