Which pull policy prevents stale image tags in Podman?

Question

Podman provides several pull policies—missing, always, never, and newer—to manage how local image caches are handled during container creation or builds. When using mutable tags like latest, the default missing policy reuses any existing local image, which can lead to environments running outdated code if the remote registry has been updated.

While --pull=always ensures the most recent image is used, it introduces a dependency on network availability and increases startup latency. The --pull=newer policy aims to balance these needs by checking registry metadata, but its reliability depends on the registry's ability to provide accurate timestamps or digests.

Given these behaviors, what are the specific trade-offs between always and newer regarding reproducibility and performance? Does --pull=newer consistently detect stale tags across all OCI-compliant registries, or is always the only way to guarantee image freshness?

Tasadduq Burney · Answer

To prevent stale image tags in Podman, use either the --pull=always or --pull=newer policy. While both prevent the use of outdated local images, they differ in how they interact with the container registry.

Comparison of Pull Policies
The missing policy (default) only pulls an image if it does not exist locally. If a remote tag (like :latest) is updated, Podman will continue using the old local version. To resolve this, choose one of the following:

Policy
      Mechanism
      Freshness Guarantee
      Performance Impact

always
      Forces a pull from the registry every time.
      Absolute
      High (Network latency on every start)

newer
      Compares local digest with remote digest.
      High (Digest-based)
      Low (Metadata check only)

Trade-offs: Reproducibility and Performance
The --pull=always policy is the only way to guarantee image freshness regardless of registry metadata support. However, it introduces a hard dependency on network availability; if the registry is unreachable, the container will fail to start. This creates a risk of downtime during registry outages.

The --pull=newer policy optimizes performance by avoiding redundant downloads. It queries the registry for the image digest; if the local digest matches the remote one, no download occurs. This provides a balance between freshness and speed.

Reliability Across Registries
The --pull=newer policy is generally reliable across OCI-compliant registries because it relies on the image digest (a content-addressable hash) rather than timestamps. However, if a registry fails to provide accurate digest metadata, Podman may fall back to missing behavior, potentially leaving you with a stale image.

Verification Steps
To verify these behaviors in your environment, use the following commands:

Verify always: Run podman run --pull=always . You should see the image being pulled even if it already exists in podman images.
  Verify newer: Run podman run --pull=newer  twice. The first run may pull the image; the second run should start almost instantly as it detects the local digest is current.
  Confirm Update: Update a tag in your registry, then run podman run --pull=newer  to ensure Podman detects the digest change and pulls the new version.

Diagnostic Detail: Are you using a private registry with a custom proxy or a non-OCI compliant mirror? This may affect the reliability of the newer policy's digest checks.

Which pull policy prevents stale image tags in Podman?

1 answer

Comparison of Pull Policies

Trade-offs: Reproducibility and Performance

Reliability Across Registries

Verification Steps

Your perspective belongs here.

0 question comments

Policy	Mechanism	Freshness Guarantee	Performance Impact
`always`	Forces a pull from the registry every time.	Absolute	High (Network latency on every start)
`newer`	Compares local digest with remote digest.	High (Digest-based)	Low (Metadata check only)