<p>We have a base image with the tag latest. This base image is being used for bunch of applications. There might be some update on the base image like ( OS upgrade, ...).</p>

<p>Do we need to rebuild and redeploy all applications when there is a change in the base image? Or, since the tag is latest and the new base image also will be with the tag latest, it will be updating in the docker layer and will be taken care without a restart? </p>

user1578872
<p>Kubernetes has an <code>imagePullPolicy:</code> setting to control this.  The default is that a node will only pull an image if it doesn’t already have it, except that if the image is using the <code>:latest</code> tag, it will always pull the image.</p>

<p>If you have a base image and then some derived image <code>FROM my/base:latest</code>, the derived image will include a specific version of the base image as its lowermost layers.  If you update the base image and don’t rebuild the derived images, they will still use the same version of the base image.  So, if you update the base image, you need to rebuild all of the deployed images.</p>

<p>If you have a running pod of some form and it’s running a <code>:latest</code> tag and the actual image that tag points at changes, Kubernetes has no way of noticing that, so you need to manually delete pods to force it to recreate them.  That’s bad.  <strong>Best practice is to use some explicit non-latest version tag</strong> (a date stamp works fine) so that you can update the image in the deployment and Kubernetes will redeploy for you.</p>
