Edit: on the other hand, does the latest nginx get pulled at time of creation?
It depends on how you have your docker compose
file set up. If you pin the version, no, it's never going to get updated unless a new version with that exact tag is released. If you omit the tag, it's going to default to whatever is tagged as latest
in the image repository, and that's only going to actually update the image when you either manually pull the image or relaunch the compose
stack.
If you want it to auto-update without relaunching the stack or manually pulling the latest image, you'd have to set up something like Watchtower and have it monitor that container.
It's so rare for me to have to use the modulo operator I'm actually excited when I come across a situation where I can.