I know this wasn't really what you were saying, but just to clear something up in case someone takes the wrong thing away from this: "python:3" definitely isn't just "non-breaking version updates" - Python 3 has and will break compatibility between versions (e.g: 3.7 turns "await" and "async" into keywords).

I guess the only thing I can say is "way to go Python"? https://semver.org defines what how breaking changes are supposed to be made, obviously for those following suit.

Lots of projects don't follow semver, unfortunately.

Python spells its major version with two integers separated with a dot; done.

AFAIK you can specify alpine:3.9.4 and alpine:3.9 for example. So I don't really understand your point.

You should also be able to pull 'latest' as well, correct?

I think the problem with specifying just 'apline:3' is that it is an ambiguous statement. Do you want alpine:3.0? Or do you want the latest in the alpine:3.x line?

I think either using 'latest' or specifying a particular point release is what you'd expect.

Edit:

> [... ]people do alpine:latest in their Dockerfiles, cross their fingers, and hope for the best.

What are you crossing your fingers for? alpine:latest should be the latest stable, and should work as intended.

I think semvar would say `3` means the latest of the major version 3, no matter the minor version.

Latest of anything is RARELY stable. It's stable until someone hits a critical bug in the new release, then there's a new version, but your image is still running the older version. That's why we invented the concept of LTS tracks.

> I think the problem with specifying just 'apline:3' is that it is an ambiguous statement.

It is not ambiguous in Docker Hub land. It's a very widely used convention that means "give me the highest 3.x.y"

It's not ambiguous. As noted by the parent of the comment you're replying to, this is standard practice with Docker images/tags.

Personally, I prefer to specify even the patch level to avoid any kind of surprise, but I can understand why some people would want to be able to specify just the major release.

> AFAIK you can specify alpine:3.9.4 and alpine:3.9 for example. So I don't really understand your point.

Easy answer:

1. :3.9.4 will be deleted the moment there's a security vulnerability in it == all your builds broken in O(weeks)

2. :3.9 probably will be deleted in a year or two == your builds will be broken in 1-2 years.

> What are you crossing your fingers for? alpine:latest should be the latest stable, and should work as intended.

The last update from 3.8 to 3.9 broke on the transition from libressl to openssl 1.1. I'm not sure such a huge version specifier would be helpful.