hardScenarioDesignMidSeniorStaff
Two replicas of the same deployment are running different code, and both were started from the same image tag. How did that happen and what do you change?
6 min readUpdated 2026-08-15Target archetype: Big Tech, Enterprise Captive, Product Startup
Answer
Short answer
A tag is a mutable pointer in the registry, so re-pushing it makes the same reference resolve to different content over time. Nodes that already cached the old digest keep serving it, so the fix is to deploy by digest and let the tag be a human label rather than the deployed identity.
Was this answer helpful?
Likely follow-ups
- Nothing in the deployment spec changed but you need every replica on the newly pushed image. What are your options and which is honest?
- You pin every image by digest. What have you given up when a base image gets a security fix, and how do you keep current?
- A digest-pinned image works on your laptop and fails to pull on an arm64 node. What does that tell you about what the digest referred to?
- How would you stop an image that never passed the pipeline from being schedulable in production at all?
Related questions
- Your pipeline deploys using a long-lived cloud access key stored as a CI secret. What would you change and why?hardAlso on supply-chain-security5 min
- What happens when a container hits its CPU limit, and what happens when it hits its memory limit?mediumAlso on containers5 min
- Your .NET service keeps getting OOM-killed in its container while the GC reports a small heap. Where has the memory gone?hardAlso on containers6 min
- What is a container image, and why is a container not a virtual machine?mediumAlso on containers5 min