Not locking it to a specific version is better for security updates. Do you want it to run stable with vulnerabilities or to run secure and broken?
The idea is that you should take responsibility for your containers and verify fixes and test your application.
> Do you want it to run stable with vulnerabilities or to run secure and broken?
If these are your two choices, you have a staffing or a workflow problem.