> container image [...] no guarantee the same thing works six months down the line when reinstalling, unless we wrote down which exact container image we downloaded

Then you should write down the exact image you downloaded. Images are tagged and hashed, you're guaranteed to download the same thing again if you ask for it.

I always explicitly request a version tag for every container image I configure in my system. If I want to upgrade, it's obvious what I'm going from and to, so I can check the changelog for breaking changes.

Are people seriously running :latest everywhere? No wonder the author thinks it's not stable.