The FreeIPA container registry at https://hub.docker.com/r/freeipa/freeipa-server/ reuses tags between releases, making it impossible for a deployment to discriminate on a known good version.

In effect, all the tags are :latest:, a well-documented anti-pattern.

If tags included the version of the underlying software along with their distribution, this would be sufficiently unique to pull a consistent version over time.