Reproducibility

A deploy that pulls images tagged latest upgrades software as a side effect. Pin every image first, and where you cannot see what runs, infer it from dates and say how sure you are.