My One-Click Setup Broke, and the Upgrade Wasn’t the Problem

My one-click setup broke in the middle of an upgrade, and the upgrade wasn’t the problem.

I was moving the starter repo for my Airflow tutorials to Airflow 3. The repo runs in GitHub Codespaces, and partway through, Codespaces started booting straight into recovery mode. The culprit wasn’t Airflow. My devcontainer pulled devcontainers/base:ubuntu, a tag that isn’t pinned to a version. It had moved to Ubuntu 26.04, where the docker-in-docker feature couldn’t install.

The fix was one line: pin the image to base:3-ubuntu24.04.

It’s an old lesson that’s easy to forget. An unpinned tag means you’re running whatever someone else published last. That applies to base images, Python packages, and GitHub Actions alike.

Pin what you depend on, and upgrade on purpose.

Do you pin everything, or let some dependencies float? Where do you draw the line?

Originally posted on LinkedIn.