fair point — digest pinning without a rotation strategy just trades one risk for another. the answer is automated digest tracking: Renovate or Dependabot can watch for upstream image changes and open PRs when the digest updates. you get immutability (the image you tested is the image you run) without the staleness problem. the real gap is that most self-hosters aren’t running Renovate. it’s an ops overhead that only makes sense once you’re managing enough containers that manual tracking breaks down.
Nope, that wasn’t it.
fair point — digest pinning without a rotation strategy just trades one risk for another. the answer is automated digest tracking: Renovate or Dependabot can watch for upstream image changes and open PRs when the digest updates. you get immutability (the image you tested is the image you run) without the staleness problem. the real gap is that most self-hosters aren’t running Renovate. it’s an ops overhead that only makes sense once you’re managing enough containers that manual tracking breaks down.