Pin the operator's own images by digest, as every other image already is

Nine references across seven modules named ':latest'. ADR 0006 forbids it and the host refuses it by name — and the refusal had never fired, because the lab pushed every image into its own registry and rewrote each reference to the digest it had just assigned. Deleting that registry made these the only manifests the host would now reject (novox/hq 04-ISSUES/039). The digests are what each tag resolves to today, read from the registry that serves them. This is a stopgap and should be said as one: a digest written into a repository is wrong the moment anybody rebuilds, which is precisely why the design has the repository name artifacts and the mesh hold digests. Until something builds and publishes, a digest that is stale is still better than a tag that silently moves. Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF
2026-09-11 01:06:14 +02:00
parent 4a1c5ac817
commit 9ff320ecca
7 changed files with 9 additions and 9 deletions
@@ -41,7 +41,7 @@
      "id": "client",
      "type": "container",
      "name": "photos-filip",
-      "image": "registry-api.novox.be/novox/photos-client:latest",
+      "image": "registry-api.novox.be/novox/photos-client@sha256:f87d63ee7bfb44c9f9748b99be6ba6dc0daf955a1d463699e9e7e3009693c0ab",
      "network": "photos-filip",
      "ports": [
        "4013:80"