Default --latest to false for stabilizing Jenkins controller containers

[sanjeevgiri]

Dependencies

https://github.com/jenkinsci/docker/blob/master/8/debian/buster/hotspot/Dockerfile#L67

Feature Request

Currently the --latest option of this tool defaults to value true. This has been causing Jenkins restart issues for our production jenkins instance. Current official docker images for Jenkins controller runs this tool on startup. During startup, Jenkins fails pod initialization due to conflict in versions of the plugin's transitive dependencies. We pin all plugins used in our Jenkins instance to a specific version for stability reasons. We would like to request to default this value to false for the reasons mentioned above.

[sanjeevgiri]

@timja This would be greatly helpful in stabilizing docker based Jenkins controller restart process. What are you thoughts on possibly defaulting to false for this option? For reference, we are using helm charts to install our Jenkins instance based on docker image defined in jenkinsci/docker

[timja]

I would recommend you use https://github.com/jenkinsci/helm-charts/tree/main/charts/jenkins#consider-using-a-custom-image

the problem with latest false is that your transitive dependencies will always install old versions.

I think that latest needs to be enhanced so that transitive dependency checking is more forgiving and it just takes the highest compatible transitive version.

Have you got an example that's failing? and the current output?

[sanjeevgiri]

@timja - Explicitly tagging you here :), forgive my ignorance if you get notified regardless of tagging and now are swimming in your flooded email inbox. I am including the information you requested below.

Plugin definition:

...
    - google-oauth-plugin:0.8
    - oauth-credentials:0.3
...

Example startup failure

applying Jenkins configuration
disable Setup Wizard
download plugins
Plugin google-oauth-plugin:0.8 depends on oauth-credentials:0.4, but there is an older version defined on the top level - oauth-credentials:0.3

It is preferable to disable upgrading to latest transitive dependency (oauth-credentials) if a lower but compatible (still satifies the requirement for google oauth plugin) version is defined. If we upgrade to latest version of transitive dependency, then we have to spend a lot of time verifying that it works across all of our existing jobs. If we do not upgrade, then jenkins restart fails.