feat: Pin installed services to semver images and normalize registry versions

src/lib/containers/start.go

@@ -38,6 +38,7 @@ func StartContainer(ctx context.Context, item types.RegistryContainer) error {
 			}
 		}
 	}
+	pinServiceImages(project, installedImage)
 	ensureServiceImages(ctx, dc, project, installedImage)
 
 	composeService, err := newComposeService(dc)
@@ -61,6 +62,26 @@ func StartContainer(ctx context.Context, item types.RegistryContainer) error {
 	return nil
 }
 
+// pinServiceImages rewrites each compose service's image reference to the exact
+// installed image (e.g. git.../testservice:3.4.0) when its base name matches, so
+// containers run pinned to a concrete semver tag instead of a moving "latest" tag.
+func pinServiceImages(project *composetypes.Project, installedImage string) {
+	if installedImage == "" {
+		return
+	}
+	for name, s := range project.Services {
+		if s.Image == "" || s.Image == installedImage {
+			continue
+		}
+		if baseImageName(s.Image) != baseImageName(installedImage) {
+			continue
+		}
+		logger.Info("Pinning service %s image %s to installed image %s", name, s.Image, installedImage)
+		s.Image = installedImage
+		project.Services[name] = s
+	}
+}
+
 // ensureServiceImages makes sure every image referenced by the compose project
 // exists locally. Registries install the image under its full reference (e.g.
 // git.../testservice:3.4) while the service's compose file often references it