Archived
austin
e9e7671644
This runner builds on the host's Docker daemon — the same daemon the live container runs on — so retagging :latest IS a deployment. Watchtower compares the running container's image against :latest, sees they differ, and recreates the container from whatever was just built locally. Gating only the push was never enough; the build itself was the deploy. The worse failure is quieter. Reassigning :latest leaves the running container's old image untagged, and once that image is pruned Watchtower can no longer read it to compare against: Failed to retrieve container image info: No such image: sha256:… Unable to update container: no available image info. bennett-portfolio hit exactly that. It sat on a four-day-old build, failing to update 720 times in twenty-four hours, reporting healthy the whole time, and had to be recreated by hand. This repo has the same workflow and the same exposure — it simply has not been unlucky yet. A PR now builds pr-<number>, which nothing watches. Trivy scans whatever was built either way, so a bad Dockerfile or a new CVE still blocks the merge, and the push step is unchanged — still main-only.