Version-Specific Tags (planned)
The English user guide is currently in beta preview. Most of the documents have been automatically translated from the Japanese version. Should you find any inaccuracies, please reach out to Flatt Security.
Version-specific tags are currently available only in a very limited scope. They are planned as a paid-plan feature around August 2026. The following is a preview of the current plan, not a finalized specification.
Takumi Images plans to decide which tags to provide based on the upstream project's release model.
Upstream release models and tag policy
Open-source upstream projects generally fall into two release models.
The first is a multiple release track model. Projects such as Go, Python, and PostgreSQL maintain multiple major or minor series in parallel and provide security fixes to each maintained series.
The second is a single release track model. Many projects continuously update only one series, and security fixes are applied only to the latest version.
Takumi Images plans to adjust its provided tags to match this upstream model.
| Upstream release model | Planned tags |
|---|---|
| Multiple release tracks | Tags for all upstream-maintained series, plus :latest |
| Single release track | :latest and the corresponding version tag |
For multiple-track upstreams, users can choose a maintained series and follow it.
For single-track upstreams, the guaranteed scope is limited to :latest and the corresponding version tag.
This boundary means Takumi Images does not independently extend the maintenance scope beyond what upstream itself fixes.
Floating tags and rebuilds
Version-specific tags are planned as floating tags.
A floating tag continues to point to the latest build within that series.
For example, a tag like python:3.13 would always point to the latest build of the 3.13 series, even if older patch versions also exist.
Even when the version number stays the same, the image is rebuilt whenever dependency fixes are incorporated.
In other words, the object pointed to by python:3.13 can be updated over time without changing the version number.
To make deployment behavior fixed, pin by digest instead of relying only on a floating tag. Digest pinning is described in the digest section of the Quickstart.
Related pages
The planned target times for vulnerability response are described in Vulnerability Response SLA (planned). See Pricing & Billing for the role of paid plans.