From ac0521cb9b6438413f0306e593afea8e78445c6e Mon Sep 17 00:00:00 2001
From: Lucas Rayan <lucas.guerra@pop-pe.rnp.br>
Date: Sat, 22 Aug 2026 10:35:53 -0300
Subject: [PATCH] =?UTF-8?q?fix(deploy):=20puxa=20a=20imagem=20publicada=20?=
 =?UTF-8?q?em=20vez=20da=20que=20est=C3=A1=20em=20cache?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Um deploy recriava os contentores mas continuava a correr o código
antigo. "latest" é uma tag móvel, e o Docker considera satisfeita
qualquer tag que já tenha localmente: o compose pedia
protocols:latest, o host já tinha uma imagem com esse nome, e a que o
Release acabara de publicar nunca era descarregada. O deploy terminava
com sucesso, os contentores reiniciavam saudáveis, e nada do que
estava a correr mudava.

Foi assim que várias correções que passaram no CI nunca chegaram ao
site: a rota /api/v1/mail/delete respondia 404 em produção enquanto
existia no código e nos testes, e a pasta Reports existia na base de
dados - a migração corre a partir da imagem certa - sem existir em
nenhuma das interfaces.

pull_policy: always nos seis serviços que consomem imagens
publicadas. Os que usam imagens de terceiros com versão fixa
(postgres:16-alpine, redis:7-alpine, clamav) ficam como estão: aí a
tag identifica um conteúdo imutável e voltar a puxar não acrescenta
nada.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 docker-compose.yaml | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/docker-compose.yaml b/docker-compose.yaml
index edb04bf..ecc4935 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -61,6 +61,11 @@ services:
   # unhealthy exactly when it has done its job.
   migrate:
     image: ${IMAGE_NAMESPACE:-ghcr.io/lucasrguerra/lambdamail}/migrations:${IMAGE_TAG:-latest}
+    # "latest" is a moving tag and Docker considers a tag it already holds
+    # locally to be satisfied, so recreating this container silently reused
+    # the cached image and the newly published one was never fetched: the
+    # deploy reported success while the running code stayed put.
+    pull_policy: always
     restart: "no"
     logging: *default-logging
     depends_on:
@@ -76,6 +81,11 @@ services:
   # ------------------------------------------------------------ RSPAMD
   rspamd:
     image: ${IMAGE_NAMESPACE:-ghcr.io/lucasrguerra/lambdamail}/rspamd:${IMAGE_TAG:-latest}
+    # "latest" is a moving tag and Docker considers a tag it already holds
+    # locally to be satisfied, so recreating this container silently reused
+    # the cached image and the newly published one was never fetched: the
+    # deploy reported success while the running code stayed put.
+    pull_policy: always
     restart: *restart
     logging: *default-logging
     environment:
@@ -131,6 +141,11 @@ services:
   # -------------------------------------------------------------- AUTH
   auth:
     image: ${IMAGE_NAMESPACE:-ghcr.io/lucasrguerra/lambdamail}/auth:${IMAGE_TAG:-latest}
+    # "latest" is a moving tag and Docker considers a tag it already holds
+    # locally to be satisfied, so recreating this container silently reused
+    # the cached image and the newly published one was never fetched: the
+    # deploy reported success while the running code stayed put.
+    pull_policy: always
     restart: *restart
     logging: *default-logging
     environment:
@@ -164,6 +179,11 @@ services:
   # ----------------------------------------------------------- STORAGE
   storage:
     image: ${IMAGE_NAMESPACE:-ghcr.io/lucasrguerra/lambdamail}/storage:${IMAGE_TAG:-latest}
+    # "latest" is a moving tag and Docker considers a tag it already holds
+    # locally to be satisfied, so recreating this container silently reused
+    # the cached image and the newly published one was never fetched: the
+    # deploy reported success while the running code stayed put.
+    pull_policy: always
     restart: *restart
     logging: *default-logging
     environment:
@@ -195,6 +215,11 @@ services:
   # --------------------------------------------------------- PROTOCOLS
   protocols:
     image: ${IMAGE_NAMESPACE:-ghcr.io/lucasrguerra/lambdamail}/protocols:${IMAGE_TAG:-latest}
+    # "latest" is a moving tag and Docker considers a tag it already holds
+    # locally to be satisfied, so recreating this container silently reused
+    # the cached image and the newly published one was never fetched: the
+    # deploy reported success while the running code stayed put.
+    pull_policy: always
     restart: *restart
     logging: *default-logging
     ports:
@@ -273,6 +298,11 @@ services:
   # -------------------------------------------------------------- WEB
   web:
     image: ${IMAGE_NAMESPACE:-ghcr.io/lucasrguerra/lambdamail}/webmail:${IMAGE_TAG:-latest}
+    # "latest" is a moving tag and Docker considers a tag it already holds
+    # locally to be satisfied, so recreating this container silently reused
+    # the cached image and the newly published one was never fetched: the
+    # deploy reported success while the running code stayed put.
+    pull_policy: always
     restart: *restart
     logging: *default-logging
     environment: