Homelab Academy / Modules
Orient, prior check, guided practice, required Feynman, reflect.
Module: Compose Operations & IaC
Activity type: Lesson (Orient → Recall → Learn → Explain → Reflect)
Learning objective: Explain why a mutable tag is unsuitable as the final deployment identity.
Bloom level: Understand / Apply
Last reviewed: 2025-03-08
Explain why a mutable tag is unsuitable as the final deployment identity.
Teach operators to distinguish mutable image tags, OCI image indexes, and platform-specific manifests; deploy an immutable repository@sha256 reference; require an out-of-band approved channel, platform, and digest; prove that dry runs and rejected updates do not mutate state; record auditable digest transitions; and perform a validated rollback without destroying the backup or failed deployment evidence.
Complete the module reading first:
Explain the update to a teammate without using the phrase secure because it is hashed.
The stable channel points to an image index, and that index lists separate manifests for amd64 and arm64. We request linux/amd64, so only the amd64 descriptor is eligible. We verify that its bytes match its descriptor, but that alone is not approval because an attacker might replace both. We also require the digest that a reviewer supplied independently and require the same channel, platform, and digest tuple in local policy. Only after all checks agree do we write repository@sha256 for the selected amd64 manifest. The audit log records the old and new digests. A dry run or rejected update performs no write. Rollback keeps the backup, saves the failed state, verifies the approved old digest, restores it, and records the reverse digest transition.
Answers save in this browser (localStorage). Completing all five fields is part of the mastery unlock.