Docker snapshot tags aren't as static as I thought

Recently I lost a good chunk of a day chasing an issue in our OWASP Dependency-Track container setup. The strange part: the problem had nothing to do with Dependency-Track itself. It was how I had configured it. What went wrong I had pinned our docker-compose.yml to a snapshot tag, something like dependencytrack/apiserver:4-snapshot . In my head, a tag like that behaves like a version number: you…