# Is it possible to always pull latest Docker image?

**URL:** <https://cwl.discourse.group/t/is-it-possible-to-always-pull-latest-docker-image/999>\
**Category:** CWL Questions\
**Created:** [April 25, 2025, 8:10am UTC](https://cwl.discourse.group/t/is-it-possible-to-always-pull-latest-docker-image/999 "2025-04-25T08:10:55Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![EmileSonneveld](https://yyz2.discourse-cdn.com/free1/user_avatar/cwl.discourse.group/emilesonneveld/32/589_2.png) [@EmileSonneveld](https://cwl.discourse.group/u/EmileSonneveld)\
**Post date:** [April 25, 2025, 8:10am UTC](https://cwl.discourse.group/t/is-it-possible-to-always-pull-latest-docker-image/999/1 "2025-04-25T08:10:56Z")

</div>

Hi,

I am developing a new CWL pipeline and often update the used Docker image.  
I use something like this:

```auto
cwlVersion: v1.0
class: CommandLineTool
requirements:
  DockerRequirement:
    dockerPull: registry.XXX.eu/my_image:1.4
...

```

Is possible to specify to always pull the latest image?  
Something like `imagePullPolicy: Always` in kubernetes.  
Our backend uses calrissian to run the CWL

Greetings,  
Emile Sonneveld

---

<div class="post-metadata">

**Author:** ![EmileSonneveld](https://yyz2.discourse-cdn.com/free1/user_avatar/cwl.discourse.group/emilesonneveld/32/589_2.png) [@EmileSonneveld](https://cwl.discourse.group/u/EmileSonneveld)\
**Post date:** [April 25, 2025, 8:25am UTC](https://cwl.discourse.group/t/is-it-possible-to-always-pull-latest-docker-image/999/2 "2025-04-25T08:25:51Z")

</div>

Besides calrissian, `cwltool 3.1.20240112164112` does not seem to pull the latest image as well.

---

<div class="post-metadata">

**Author:** ![mrc](https://yyz2.discourse-cdn.com/free1/user_avatar/cwl.discourse.group/mrc/32/3_2.png) [@mrc](https://cwl.discourse.group/u/mrc)\
**Post date:** [April 26, 2025, 8:40am UTC](https://cwl.discourse.group/t/is-it-possible-to-always-pull-latest-docker-image/999/3 "2025-04-26T08:40:58Z")

</div>

Hello @EmileSonneveld and welcome!

There is a [`--force-docker-pull`](https://cwltool.readthedocs.io/en/latest/cli.html#cmdoption-cwltool-force-docker-pull) command line options for `cwltool`. Since Calrissian is built upon `cwltool`, maybe it also supports that option?

---

<div class="post-metadata">

**Author:** ![FabriceBrito](https://yyz2.discourse-cdn.com/free1/user_avatar/cwl.discourse.group/fabricebrito/32/114_2.png) [@FabriceBrito](https://cwl.discourse.group/u/FabriceBrito)\
**Post date:** [September 22, 2025, 3:47pm UTC](https://cwl.discourse.group/t/is-it-possible-to-always-pull-latest-docker-image/999/4 "2025-09-22T15:47:05Z")

</div>

In the case of calrissian, if the image is in the node’s cache, it won’t be pulled again.

IMO the best strategy is to use the sha256 in `dockerPull`:

```auto
DockerRequirement:
        dockerPull: ghcr.io/eoap/application-package-patterns/runner@sha256:09cef32f5f09171b6e9ebf145da5d40bef6061c68758643e223c38f2415a1ee0

```