Tags in execution environment images

This might well be a wee bit off-topic for this forum, but as I’m building awx execution environment images, I’m hoping somebody can help me.

I build an EE image with multiple tags like this:

$ ansible-builder build --squash all --tag REPO/wheel:latest --tag REPO/wheel:1.7
$ podman push REPO/wheel:latest

and push the image to a package repository hosted on a local Forgejo (gitea) installation. When looking at the list of packages, I see a version :latest.

What I’d actually like to see is a version 1.7, say, which can also be pulled with the tag :latest, but the only way I seem to be able to accomplish this is with two distinct podman push, one for :1.7 and the other for :latest.

Is this normal or am I using ansible-builder incorrectly?

ansible-builder: 3.0.1
podman: 4.3.1
debian: 12
forgejo: 1.21.8

the only way I seem to be able to accomplish this is with two distinct podman push , one for :1.7 and the other for :latest .

AFAIK, this is intended. You shoukd invoke podman push twice.

docker push has an option --all-tags that can push all tags of the same image (docker push REPO/wheel --all-tags), but podman push does not have this option.

It appears that an implementation of the same option has been proposed for Podman in the past, but has been passed over to avoid a situation where unintended images are pushed together. Indeed, the --all-tags option can be a bit overkill because it pushes all tags anyway, even if the IMAGE IDs are different.


Thank you, @kurokobo

I think I’ll then just push the numbered tag (:1.7). It seems sensible to me at this point to force AWX users to think about the EE version they want to run and not let them just say :latest.

(Opinions gladly heard! :slight_smile: )

Agree with you, I too think latest should not be used much. The latest will cause trouble in the long term.

The users won’t notice if the latest is updated, and if a job fails because of updated latest, any way to use the old image again never be provided to users. Not only that, if the cached latest image differs from node to node, it is possible for a job to fail only when it is launched on a particular node.

Similar discussion is here: Bind EE images version with DEFAULT_AWX_VERSION by bartowl · Pull Request #1740 · ansible/awx-operator · GitHub