> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://hiddenlayer.ferndocs.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://hiddenlayer.ferndocs.com/_mcp/server.

# Updating the Container Image

Update the AI Runtime Security container image deployed to Kubernetes when a new version is released.

## Overview

The container image is hosted on [Quay.io](https://quay.io) and referenced in the deployment manifest:

```yaml
image: quay.io/hiddenlayer/distro-enterprise-aidr-genai:<tag>
```

> **Avoid the latest tag**
>
> Do not use the `:latest` tag in production. Kubernetes will not detect a change if the tag stays the same, so new images won't be pulled automatically. Use explicit version tags (e.g., `26.1.0`) to ensure updates are applied reliably.

## Prerequisites

* `kubectl` configured with access to your cluster
* Access to the Quay.io registry (`quay.io/hiddenlayer`) with valid credentials and `imagePullSecret` configured in your cluster
* Your deployment name and namespace (referenced as `$NAMESPACE` and `aidr-genai` in the commands below)

## Release Workflow

### Step 1: Identify the new image tag

HiddenLayer publishes [release notes](https://docs.hiddenlayer.ai/docs/products/runtime/releasenotes) for each new version. When you receive a release notification, use the tag from the release notes in the steps below.

New releases are published to Quay.io. Find the version you want to deploy:

```
quay.io/hiddenlayer/distro-enterprise-aidr-genai:$TAG
```

You do not need to pull the image locally, as Kubernetes pulls it directly from the registry during the rolling update.

### Step 2: Apply the update

You can update the image using either the manifest file or a direct `kubectl` patch.

#### Update manifest (recommended)

Edit the image tag in your deployment manifest:

```yaml
image: quay.io/hiddenlayer/distro-enterprise-aidr-genai:$TAG
```

Apply the updated manifest:

```bash
kubectl apply -f $MANIFEST_FILE.yaml
```

Kubernetes detects the tag change and triggers a rolling update automatically.

#### Patch inline

Update the image directly without editing the manifest file:

```bash
kubectl set image deployment/aidr-genai \
  service=quay.io/hiddenlayer/distro-enterprise-aidr-genai:$TAG \
  -n $NAMESPACE
```

### Step 3: Verify the rollout

Monitor the rolling update until it completes:

```bash
kubectl rollout status deployment/aidr-genai -n $NAMESPACE
```

When the rollout is complete, you will see:

```
deployment "aidr-genai" successfully rolled out
```

## Rolling Back

If the new image causes issues, roll back to the previous version:

```bash
kubectl rollout undo deployment/aidr-genai -n $NAMESPACE
```

To roll back to a specific revision:

```bash
kubectl rollout history deployment/aidr-genai -n $NAMESPACE
kubectl rollout undo deployment/aidr-genai --to-revision=$REVISION -n $NAMESPACE
```

> **Keep your manifest in sync**
>
> After rolling back, update the image tag in your deployment manifest to match the version now running in the cluster. If the manifest still references the newer tag, the next `kubectl apply` will re-deploy the broken version.

## Versioned vs. Latest Tags

|                            | Versioned tag (`:26.1.0`) | `:latest` |
| -------------------------- | ------------------------- | --------- |
| Kubernetes detects change  | ✅ Yes                     | ❌ No      |
| Reliable rolling updates   | ✅ Yes                     | ❌ No      |
| Easy rollback              | ✅ Yes                     | ❌ No      |
| Recommended for production | ✅ Yes                     | ❌ No      |