From 89e27f0e742e1f8996c23031f05918bdc5622255 Mon Sep 17 00:00:00 2001
From: atif09 <mohdatif.contact@gmail.com>
Date: Sat, 24 Jan 2026 14:15:39 +0530
Subject: [PATCH 01/10] [docker-compose] Add DOCKER_TAG variable for version
 pinning #554

this change introduces a DOCKER_TAG environment variable that allows
users to pin specific image versions in .env file. Both 'docker compose pull'
and 'make pull' now respect this variable, ensuring consistent version
behavior across all deployment methods.

Changes:
- Add DOCKER_TAG=latest to .env file
- Update all OpenWISP image tags in docker-compose.yml to use ${DOCKER_TAG:-latest}
- Update Makefile to include .env and use DOCKER_TAG when retagging images

Fixes #554
---
 .env               |  1 +
 Makefile           |  5 ++++-
 docker-compose.yml | 20 ++++++++++----------
 3 files changed, 15 insertions(+), 11 deletions(-)

diff --git a/.env b/.env
index a30eda7d..a4530f1a 100644
--- a/.env
+++ b/.env
@@ -63,3 +63,4 @@ CELERY_SERVICE_NETWORK_MODE=service:openvpn
 METRIC_COLLECTION=True
 # collectstatic
 COLLECTSTATIC_WHEN_DEPS_CHANGE=true
+DOCKER_TAG=latest
\ No newline at end of file
diff --git a/Makefile b/Makefile
index 97545ab9..06bd0f57 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,9 @@
 # Find documentation in README.md under
 # the heading "Makefile Options".
 
+include .env
+export
+
 OPENWISP_VERSION = 25.10.0
 SHELL := /bin/bash
 .SILENT: clean pull start stop
@@ -20,7 +23,7 @@ pull:
 				 'openwisp-freeradius' 'openwisp-nginx' 'openwisp-openvpn' 'openwisp-postfix' \
 				 'openwisp-websocket' ; do \
 		docker pull --quiet $(USER)/$${image}:$(TAG); \
-		docker tag  $(USER)/$${image}:$(TAG) openwisp/$${image}:latest; \
+		docker tag  $(USER)/$${image}:$(TAG) openwisp/$${image}:$${DOCKER_TAG}; \
 	done
 
 # Build
diff --git a/docker-compose.yml b/docker-compose.yml
index f010ae3b..4e47e98a 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -12,7 +12,7 @@ x-celery-depends-on: &celery-depends-on
 
 services:
   dashboard:
-    image: openwisp/openwisp-dashboard:latest
+    image: openwisp/openwisp-dashboard:${DOCKER_TAG:-latest}
     restart: always
     build:
       context: images
@@ -35,7 +35,7 @@ services:
       - influxdb
 
   api:
-    image: openwisp/openwisp-api:latest
+    image: openwisp/openwisp-api:${DOCKER_TAG:-latest}
     restart: always
     build:
       context: images
@@ -55,7 +55,7 @@ services:
       - dashboard
 
   websocket:
-    image: openwisp/openwisp-websocket:latest
+    image: openwisp/openwisp-websocket:${DOCKER_TAG:-latest}
     restart: always
     build:
       context: images
@@ -70,7 +70,7 @@ services:
       - dashboard
 
   celery:
-    image: openwisp/openwisp-dashboard:latest
+    image: openwisp/openwisp-dashboard:${DOCKER_TAG:-latest}
     restart: always
     environment:
       - MODULE_NAME=celery
@@ -85,7 +85,7 @@ services:
     network_mode: "${CELERY_SERVICE_NETWORK_MODE-service:openvpn}"
 
   celery_monitoring:
-    image: openwisp/openwisp-dashboard:latest
+    image: openwisp/openwisp-dashboard:${DOCKER_TAG:-latest}
     restart: always
     environment:
       - MODULE_NAME=celery_monitoring
@@ -99,7 +99,7 @@ services:
     network_mode: "${CELERY_SERVICE_NETWORK_MODE-service:openvpn}"
 
   celerybeat:
-    image: openwisp/openwisp-dashboard:latest
+    image: openwisp/openwisp-dashboard:${DOCKER_TAG:-latest}
     restart: always
     environment:
       - MODULE_NAME=celerybeat
@@ -113,7 +113,7 @@ services:
       - dashboard
 
   nginx:
-    image: openwisp/openwisp-nginx:latest
+    image: openwisp/openwisp-nginx:${DOCKER_TAG:-latest}
     restart: always
     build:
       context: images
@@ -140,7 +140,7 @@ services:
       - websocket
 
   freeradius:
-    image: openwisp/openwisp-freeradius:latest
+    image: openwisp/openwisp-freeradius:${DOCKER_TAG:-latest}
     restart: always
     build:
       context: images
@@ -156,7 +156,7 @@ services:
       - dashboard
 
   postfix:
-    image: openwisp/openwisp-postfix:latest
+    image: openwisp/openwisp-postfix:${DOCKER_TAG:-latest}
     restart: always
     build:
       context: images
@@ -167,7 +167,7 @@ services:
       - openwisp_certs:/etc/ssl/mail
 
   openvpn:
-    image: openwisp/openwisp-openvpn:latest
+    image: openwisp/openwisp-openvpn:${DOCKER_TAG:-latest}
     restart: on-failure
     build:
       context: images

From a4f27a0a997f6d5019988e954ff08d81a25558e9 Mon Sep 17 00:00:00 2001
From: atif09 <mohdatif.contact@gmail.com>
Date: Sat, 24 Jan 2026 15:01:49 +0530
Subject: [PATCH 02/10] [docker-compose] Fix linter warnings for DOCKER_TAG
 #554

Move DOCKER_TAG variable placement in .env file to satisfy
alphabetical ordering requirements and add missing EOF newline.
Update Makefile to use fallback value for DOCKER_TAG variable.

Related to #554
---
 .env     | 2 +-
 Makefile | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.env b/.env
index a4530f1a..eb9e7bb4 100644
--- a/.env
+++ b/.env
@@ -8,6 +8,7 @@ API_DOMAIN=api.openwisp.org
 SSH_PRIVATE_KEY_PATH=/home/openwisp/.ssh/id_ed25519
 SSH_PUBLIC_KEY_PATH=/home/openwisp/.ssh/id_ed25519.pub
 VPN_DOMAIN=openvpn.openwisp.org
+DOCKER_TAG=25.10.0
 EMAIL_DJANGO_DEFAULT=example@example.org
 DB_USER=admin
 DB_PASS=admin
@@ -63,4 +64,3 @@ CELERY_SERVICE_NETWORK_MODE=service:openvpn
 METRIC_COLLECTION=True
 # collectstatic
 COLLECTSTATIC_WHEN_DEPS_CHANGE=true
-DOCKER_TAG=latest
\ No newline at end of file
diff --git a/Makefile b/Makefile
index 06bd0f57..6fd591fa 100644
--- a/Makefile
+++ b/Makefile
@@ -23,7 +23,7 @@ pull:
 				 'openwisp-freeradius' 'openwisp-nginx' 'openwisp-openvpn' 'openwisp-postfix' \
 				 'openwisp-websocket' ; do \
 		docker pull --quiet $(USER)/$${image}:$(TAG); \
-		docker tag  $(USER)/$${image}:$(TAG) openwisp/$${image}:$${DOCKER_TAG}; \
+		docker tag  $(USER)/$${image}:$(TAG) openwisp/$${image}:$${DOCKER_TAG:-latest}; \
 	done
 
 # Build

From aa3db9755ffbd15c819e9df34bf54cc25185ea36 Mon Sep 17 00:00:00 2001
From: atif09 <mohdatif.contact@gmail.com>
Date: Sat, 31 Jan 2026 22:28:40 +0530
Subject: [PATCH 03/10] [fix] Changed DOCKER_TAG back to latest #554

Keeping DOCKER_TAG=latest avoids manual updating with each release, users will have to change this to the specific version by explicitly setting it to the desired version

Related to #554
---
 .env | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.env b/.env
index 3f8b451e..5787494c 100644
--- a/.env
+++ b/.env
@@ -8,7 +8,7 @@ API_DOMAIN=api.openwisp.org
 SSH_PRIVATE_KEY_PATH=/home/openwisp/.ssh/id_ed25519
 SSH_PUBLIC_KEY_PATH=/home/openwisp/.ssh/id_ed25519.pub
 VPN_DOMAIN=openvpn.openwisp.org
-DOCKER_TAG=25.10.0
+DOCKER_TAG=latest
 EMAIL_DJANGO_DEFAULT=example@example.org
 DB_USER=admin
 DB_PASS=admin

From 064b758f02130f2d3ee3c6a3b72cec3636d2c137 Mon Sep 17 00:00:00 2001
From: atif09 <mohdatif.contact@gmail.com>
Date: Sat, 31 Jan 2026 22:40:32 +0530
Subject: [PATCH 04/10] [format] Changed DOCKER_TAG back to latest #554

dotenv-linter expects DOCKER_TAG to appear before SSH_PRIVATE_KEY_PATH

Related to #554
---
 .env | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.env b/.env
index 5787494c..450adb30 100644
--- a/.env
+++ b/.env
@@ -4,11 +4,12 @@
 # Essential
 DASHBOARD_DOMAIN=dashboard.openwisp.org
 API_DOMAIN=api.openwisp.org
+# Image tag pinning
+DOCKER_TAG=latest
 # SSH Credentials Configurations
 SSH_PRIVATE_KEY_PATH=/home/openwisp/.ssh/id_ed25519
 SSH_PUBLIC_KEY_PATH=/home/openwisp/.ssh/id_ed25519.pub
 VPN_DOMAIN=openvpn.openwisp.org
-DOCKER_TAG=latest
 EMAIL_DJANGO_DEFAULT=example@example.org
 DB_USER=admin
 DB_PASS=admin

From b6b4e6f6e87c3e32439a36e3301a489ee7deab98 Mon Sep 17 00:00:00 2001
From: atif09 <mohdatif.contact@gmail.com>
Date: Mon, 16 Feb 2026 19:56:35 +0530
Subject: [PATCH 05/10] [fix] Add OPENWISP_VERSION variable for version pinning
 #554

Introduces OPENWISP_VERSION environment variable to control image versions:
- .env defaults to edge for development
- auto-install.sh writes latest for production deployments
- docker-compose.yml uses edge for all services
- Makefile reads from .env and uses separate RELEASE_VERSION for releases

Fixes #554
---
 .env                   |  2 +-
 Makefile               |  6 +++---
 deploy/auto-install.sh | 10 +++++-----
 docker-compose.yml     | 20 ++++++++++----------
 4 files changed, 19 insertions(+), 19 deletions(-)

diff --git a/.env b/.env
index 450adb30..ba137cdb 100644
--- a/.env
+++ b/.env
@@ -5,7 +5,7 @@
 DASHBOARD_DOMAIN=dashboard.openwisp.org
 API_DOMAIN=api.openwisp.org
 # Image tag pinning
-DOCKER_TAG=latest
+OPENWISP_VERSION=edge
 # SSH Credentials Configurations
 SSH_PRIVATE_KEY_PATH=/home/openwisp/.ssh/id_ed25519
 SSH_PUBLIC_KEY_PATH=/home/openwisp/.ssh/id_ed25519.pub
diff --git a/Makefile b/Makefile
index 6fd591fa..319b5d37 100644
--- a/Makefile
+++ b/Makefile
@@ -4,7 +4,7 @@
 include .env
 export
 
-OPENWISP_VERSION = 25.10.0
+RELEASE_VERSION = 25.10.0
 SHELL := /bin/bash
 .SILENT: clean pull start stop
 
@@ -23,7 +23,7 @@ pull:
 				 'openwisp-freeradius' 'openwisp-nginx' 'openwisp-openvpn' 'openwisp-postfix' \
 				 'openwisp-websocket' ; do \
 		docker pull --quiet $(USER)/$${image}:$(TAG); \
-		docker tag  $(USER)/$${image}:$(TAG) openwisp/$${image}:$${DOCKER_TAG:-latest}; \
+		docker tag  $(USER)/$${image}:$(TAG) openwisp/$${image}:$${OPENWISP_VERSION:-edge}; \
 	done
 
 # Build
@@ -120,4 +120,4 @@ publish:
 
 release:
 	make publish TAG=latest SKIP_TESTS=true
-	make publish TAG=$(OPENWISP_VERSION) SKIP_BUILD=true SKIP_TESTS=true
+	make publish TAG=$(RELEASE_VERSION) SKIP_BUILD=true SKIP_TESTS=true
diff --git a/deploy/auto-install.sh b/deploy/auto-install.sh
index 02482824..50f88c5f 100755
--- a/deploy/auto-install.sh
+++ b/deploy/auto-install.sh
@@ -62,7 +62,7 @@ get_version_from_user() {
 	echo -ne ${GRN}"OpenWISP Version (leave blank for latest): "${NON}
 	read openwisp_version
 	if [[ -z "$openwisp_version" ]]; then
-		openwisp_version=$(curl -L --silent https://api.github.com/repos/openwisp/docker-openwisp/releases/latest | jq -r .tag_name)
+		openwisp_version="latest"
 	fi
 }
 
@@ -128,7 +128,7 @@ setup_docker_openwisp() {
 
 	cd $INSTALL_PATH &>>$LOG_FILE
 	check_status $? "docker-openwisp download failed."
-	echo $openwisp_version >$INSTALL_PATH/VERSION
+	set_env "OPENWISP_VERSION" "$openwisp_version"
 
 	if [[ ! -f "$env_path" ]]; then
 		# Dashboard Domain
@@ -179,7 +179,7 @@ setup_docker_openwisp() {
 	start_step "Configuring docker-openwisp..."
 	report_ok
 	start_step "Starting images docker-openwisp (this will take a while)..."
-	make start TAG=$(cat $INSTALL_PATH/VERSION) -C $INSTALL_PATH/ &>>$LOG_FILE
+	make start -C $INSTALL_PATH/ &>>$LOG_FILE	
 	check_status $? "Starting openwisp failed."
 }
 
@@ -192,7 +192,7 @@ upgrade_docker_openwisp() {
 
 	cd $INSTALL_PATH &>>$LOG_FILE
 	check_status $? "docker-openwisp download failed."
-	echo $openwisp_version >$INSTALL_PATH/VERSION
+	set_env "OPENWISP_VERSION" "$openwisp_version"
 
 	start_step "Configuring docker-openwisp..."
 	for config in $(grep '=' $ENV_BACKUP | cut -f1 -d'='); do
@@ -202,7 +202,7 @@ upgrade_docker_openwisp() {
 	report_ok
 
 	start_step "Starting images docker-openwisp (this will take a while)..."
-	make start TAG=$(cat $INSTALL_PATH/VERSION) -C $INSTALL_PATH/ &>>$LOG_FILE
+	make start -C $INSTALL_PATH/ &>>$LOG_FILE	
 	check_status $? "Starting openwisp failed."
 }
 
diff --git a/docker-compose.yml b/docker-compose.yml
index 4e47e98a..98e81c4d 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -12,7 +12,7 @@ x-celery-depends-on: &celery-depends-on
 
 services:
   dashboard:
-    image: openwisp/openwisp-dashboard:${DOCKER_TAG:-latest}
+    image: openwisp/openwisp-dashboard:${OPENWISP_VERSION:-edge}
     restart: always
     build:
       context: images
@@ -35,7 +35,7 @@ services:
       - influxdb
 
   api:
-    image: openwisp/openwisp-api:${DOCKER_TAG:-latest}
+    image: openwisp/openwisp-api:${OPENWISP_VERSION:-edge}
     restart: always
     build:
       context: images
@@ -55,7 +55,7 @@ services:
       - dashboard
 
   websocket:
-    image: openwisp/openwisp-websocket:${DOCKER_TAG:-latest}
+    image: openwisp/openwisp-websocket:${OPENWISP_VERSION:-edge}
     restart: always
     build:
       context: images
@@ -70,7 +70,7 @@ services:
       - dashboard
 
   celery:
-    image: openwisp/openwisp-dashboard:${DOCKER_TAG:-latest}
+    image: openwisp/openwisp-dashboard:${OPENWISP_VERSION:-edge}
     restart: always
     environment:
       - MODULE_NAME=celery
@@ -85,7 +85,7 @@ services:
     network_mode: "${CELERY_SERVICE_NETWORK_MODE-service:openvpn}"
 
   celery_monitoring:
-    image: openwisp/openwisp-dashboard:${DOCKER_TAG:-latest}
+    image: openwisp/openwisp-dashboard:${OPENWISP_VERSION:-edge}
     restart: always
     environment:
       - MODULE_NAME=celery_monitoring
@@ -99,7 +99,7 @@ services:
     network_mode: "${CELERY_SERVICE_NETWORK_MODE-service:openvpn}"
 
   celerybeat:
-    image: openwisp/openwisp-dashboard:${DOCKER_TAG:-latest}
+    image: openwisp/openwisp-dashboard:${OPENWISP_VERSION:-edge}
     restart: always
     environment:
       - MODULE_NAME=celerybeat
@@ -113,7 +113,7 @@ services:
       - dashboard
 
   nginx:
-    image: openwisp/openwisp-nginx:${DOCKER_TAG:-latest}
+    image: openwisp/openwisp-nginx:${OPENWISP_VERSION:-edge}
     restart: always
     build:
       context: images
@@ -140,7 +140,7 @@ services:
       - websocket
 
   freeradius:
-    image: openwisp/openwisp-freeradius:${DOCKER_TAG:-latest}
+    image: openwisp/openwisp-freeradius:${OPENWISP_VERSION:-edge}
     restart: always
     build:
       context: images
@@ -156,7 +156,7 @@ services:
       - dashboard
 
   postfix:
-    image: openwisp/openwisp-postfix:${DOCKER_TAG:-latest}
+    image: openwisp/openwisp-postfix:${OPENWISP_VERSION:-edge}
     restart: always
     build:
       context: images
@@ -167,7 +167,7 @@ services:
       - openwisp_certs:/etc/ssl/mail
 
   openvpn:
-    image: openwisp/openwisp-openvpn:${DOCKER_TAG:-latest}
+    image: openwisp/openwisp-openvpn:${OPENWISP_VERSION:-edge}
     restart: on-failure
     build:
       context: images

From 23dd5bc9d7e897556e3ab5fbfb9387e06ff10362 Mon Sep 17 00:00:00 2001
From: atif09 <mohdatif.contact@gmail.com>
Date: Mon, 16 Feb 2026 23:09:50 +0530
Subject: [PATCH 06/10] [fix] Use OPENWISP_VERSION in Makefile pull target #554

Previously, the pull target always pulled the :edge image and retagged
it as OPENWISP_VERSION, meaning production deployments would run dev
images labelled as a release version.

Now the pull target uses OPENWISP_VERSION directly for both pulling
and tagging, ensuring the correct image version is used.

Fixes #554
---
 Makefile               | 5 +++--
 deploy/auto-install.sh | 2 +-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/Makefile b/Makefile
index 319b5d37..67a1fc8e 100644
--- a/Makefile
+++ b/Makefile
@@ -22,8 +22,9 @@ pull:
 	for image in 'openwisp-base' 'openwisp-nfs' 'openwisp-api' 'openwisp-dashboard' \
 				 'openwisp-freeradius' 'openwisp-nginx' 'openwisp-openvpn' 'openwisp-postfix' \
 				 'openwisp-websocket' ; do \
-		docker pull --quiet $(USER)/$${image}:$(TAG); \
-		docker tag  $(USER)/$${image}:$(TAG) openwisp/$${image}:$${OPENWISP_VERSION:-edge}; \
+				version=$${OPENWISP_VERSION:-edge}; \
+				docker pull --quiet $(USER)/$${image}:$${version}; \
+				docker tag  $(USER)/$${image}:$${version} openwisp/$${image}:$${version}; \	
 	done
 
 # Build
diff --git a/deploy/auto-install.sh b/deploy/auto-install.sh
index 50f88c5f..65c29d5d 100755
--- a/deploy/auto-install.sh
+++ b/deploy/auto-install.sh
@@ -87,7 +87,7 @@ download_docker_openwisp() {
 		rm -rf $INSTALL_PATH &>>$LOG_FILE
 	fi
 	if [ -z "$GIT_BRANCH" ]; then
-		if [[ "$openwisp_version" == "edge" ]]; then
+		if [[ "$openwisp_version" == "edge" || "$openwisp_version" == "latest" ]]; then
 			GIT_BRANCH="master"
 		else
 			GIT_BRANCH="$openwisp_version"

From 7d6f7683813fe8bf9d608f6c86a99369cafdf478 Mon Sep 17 00:00:00 2001
From: atif09 <mohdatif.contact@gmail.com>
Date: Tue, 17 Feb 2026 21:32:48 +0530
Subject: [PATCH 07/10] [fix] Address review comments #554

- Restored curl API call
- Removed latest from the edge condition
- Removed the redundant horizontal blank space
- Added /openwisp-base: and /openwisp-nfs: to the docker rmi list in clean target so locally-tagged images get removed too
- Replaced openwisp/391495{image}:latest with /391495{image}: as the source for docker tag, and removed the stale inline comments in publish target

Related to #554
---
 .env                   |  1 +
 Makefile               | 19 +++++++++----------
 deploy/auto-install.sh | 16 ++++++++--------
 3 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/.env b/.env
index ba137cdb..b825f0f4 100644
--- a/.env
+++ b/.env
@@ -5,6 +5,7 @@
 DASHBOARD_DOMAIN=dashboard.openwisp.org
 API_DOMAIN=api.openwisp.org
 # Image tag pinning
+IMAGE_OWNER=openwisp
 OPENWISP_VERSION=edge
 # SSH Credentials Configurations
 SSH_PRIVATE_KEY_PATH=/home/openwisp/.ssh/id_ed25519
diff --git a/Makefile b/Makefile
index 67a1fc8e..f0051d1d 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,6 @@
 # the heading "Makefile Options".
 
 include .env
-export
 
 RELEASE_VERSION = 25.10.0
 SHELL := /bin/bash
@@ -22,9 +21,8 @@ pull:
 	for image in 'openwisp-base' 'openwisp-nfs' 'openwisp-api' 'openwisp-dashboard' \
 				 'openwisp-freeradius' 'openwisp-nginx' 'openwisp-openvpn' 'openwisp-postfix' \
 				 'openwisp-websocket' ; do \
-				version=$${OPENWISP_VERSION:-edge}; \
-				docker pull --quiet $(USER)/$${image}:$${version}; \
-				docker tag  $(USER)/$${image}:$${version} openwisp/$${image}:$${version}; \	
+		docker pull --quiet $(USER)/$${image}:$(OPENWISP_VERSION); \
+		docker tag  $(USER)/$${image}:$(OPENWISP_VERSION) $(IMAGE_OWNER)/$${image}:$(OPENWISP_VERSION); \
 	done
 
 # Build
@@ -45,11 +43,13 @@ base-build:
 	             $$BUILD_ARGS; \
 	docker build --tag openwisp/openwisp-base:latest \
 	             --file ./images/openwisp_base/Dockerfile ./images/ \
-	             $$BUILD_ARGS
+	             $$BUILD_ARGS; \
+	docker tag openwisp/openwisp-base:latest $(IMAGE_OWNER)/openwisp-base:$(OPENWISP_VERSION)
 
 nfs-build:
 	docker build --tag openwisp/openwisp-nfs:latest \
-	             --file ./images/openwisp_nfs/Dockerfile ./images/
+	             --file ./images/openwisp_nfs/Dockerfile ./images/; \
+	docker tag openwisp/openwisp-nfs:latest $(IMAGE_OWNER)/openwisp-nfs:$(OPENWISP_VERSION)
 
 compose-build: base-build
 	docker compose build --parallel
@@ -80,6 +80,8 @@ clean:
 				openwisp/openwisp-base:intermedia-system \
 				openwisp/openwisp-base:intermedia-python \
 				openwisp/openwisp-nfs:latest \
+				$(IMAGE_OWNER)/openwisp-base:$(OPENWISP_VERSION) \
+				$(IMAGE_OWNER)/openwisp-nfs:$(OPENWISP_VERSION) \
 				`docker images -f "dangling=true" -q` \
 				`docker images | grep openwisp/docker-openwisp | tr -s ' ' | cut -d ' ' -f 3` &> /dev/null
 
@@ -109,10 +111,7 @@ publish:
 	for image in 'openwisp-base' 'openwisp-nfs' 'openwisp-api' 'openwisp-dashboard' \
 				 'openwisp-freeradius' 'openwisp-nginx' 'openwisp-openvpn' 'openwisp-postfix' \
 				 'openwisp-websocket' ; do \
-		# Docker images built locally are tagged "latest" by default. \
-		# This script updates the tag of each built image to a user-defined tag \
-		# and pushes the newly tagged image to a Docker registry under the user's namespace. \
-		docker tag openwisp/$${image}:latest $(USER)/$${image}:$(TAG); \
+		docker tag $(IMAGE_OWNER)/$${image}:$(OPENWISP_VERSION) $(USER)/$${image}:$(TAG); \
 		docker push $(USER)/$${image}:$(TAG); \
 		if [ "$(TAG)" != "latest" ]; then \
 			docker rmi $(USER)/$${image}:$(TAG); \
diff --git a/deploy/auto-install.sh b/deploy/auto-install.sh
index 65c29d5d..14451183 100755
--- a/deploy/auto-install.sh
+++ b/deploy/auto-install.sh
@@ -59,11 +59,11 @@ apt_dependenices_setup() {
 }
 
 get_version_from_user() {
-	echo -ne ${GRN}"OpenWISP Version (leave blank for latest): "${NON}
-	read openwisp_version
-	if [[ -z "$openwisp_version" ]]; then
-		openwisp_version="latest"
-	fi
+    echo -ne ${GRN}"OpenWISP Version (leave blank for latest stable release): "${NON}
+    read openwisp_version
+    if [[ -z "$openwisp_version" ]]; then
+        openwisp_version=$(curl -L --silent https://api.github.com/repos/openwisp/docker-openwisp/releases/latest | jq -r .tag_name)
+    fi
 }
 
 setup_docker() {
@@ -87,7 +87,7 @@ download_docker_openwisp() {
 		rm -rf $INSTALL_PATH &>>$LOG_FILE
 	fi
 	if [ -z "$GIT_BRANCH" ]; then
-		if [[ "$openwisp_version" == "edge" || "$openwisp_version" == "latest" ]]; then
+		if [[ "$openwisp_version" == "edge" ]]; then
 			GIT_BRANCH="master"
 		else
 			GIT_BRANCH="$openwisp_version"
@@ -179,7 +179,7 @@ setup_docker_openwisp() {
 	start_step "Configuring docker-openwisp..."
 	report_ok
 	start_step "Starting images docker-openwisp (this will take a while)..."
-	make start -C $INSTALL_PATH/ &>>$LOG_FILE	
+	make start -C $INSTALL_PATH/ &>>$LOG_FILE
 	check_status $? "Starting openwisp failed."
 }
 
@@ -202,7 +202,7 @@ upgrade_docker_openwisp() {
 	report_ok
 
 	start_step "Starting images docker-openwisp (this will take a while)..."
-	make start -C $INSTALL_PATH/ &>>$LOG_FILE	
+	make start -C $INSTALL_PATH/ &>>$LOG_FILE
 	check_status $? "Starting openwisp failed."
 }
 

From 7e2f422a51872da3dd6256f0bc7aa1484863e4d6 Mon Sep 17 00:00:00 2001
From: atif09 <mohdatif.contact@gmail.com>
Date: Tue, 17 Feb 2026 23:01:42 +0530
Subject: [PATCH 08/10] [fix] Address review comments and nitpicks by code
 rabbit #554

- Added conditional defaults so the Makefile is self-contained
- Added inline comments for OPENWISP_VERSION

Related to #554
---
 .env     | 1 +
 Makefile | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/.env b/.env
index 774b434b..1967becc 100644
--- a/.env
+++ b/.env
@@ -6,6 +6,7 @@ DASHBOARD_DOMAIN=dashboard.openwisp.org
 API_DOMAIN=api.openwisp.org
 # Image tag pinning
 IMAGE_OWNER=openwisp
+# OPENWISP_VERSION: Image tag version (e.g., "25.10.0", "latest", or "edge")
 OPENWISP_VERSION=edge
 # SSH Credentials Configurations
 SSH_PRIVATE_KEY_PATH=/home/openwisp/.ssh/id_ed25519
diff --git a/Makefile b/Makefile
index f0051d1d..cefee39e 100644
--- a/Makefile
+++ b/Makefile
@@ -11,6 +11,8 @@ default: compose-build
 
 USER = registry.gitlab.com/openwisp/docker-openwisp
 TAG = edge
+OPENWISP_VERSION ?= edge
+IMAGE_OWNER ?= openwisp
 SKIP_PULL ?= false
 SKIP_BUILD ?= false
 SKIP_TESTS ?= false

From d1355716ce5dc821db61d17b276d1dd3f00d3bf0 Mon Sep 17 00:00:00 2001
From: atif09 <mohdatif.contact@gmail.com>
Date: Thu, 26 Feb 2026 02:13:44 +0530
Subject: [PATCH 09/10] [chores] Clearer comments #554

Added comments to clarify the purpose of RELEASE_VERSION and OPENWISP_VERSION and to note that .env can override Makefile variables if needed

Related to #554
---
 Makefile | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index cefee39e..94b88526 100644
--- a/Makefile
+++ b/Makefile
@@ -1,8 +1,9 @@
 # Find documentation in README.md under
 # the heading "Makefile Options".
 
-include .env
+include .env # The .env file can override variables in the Makefile, if needed
 
+# RELEASE_VERSION: version string used when tagging a new release.
 RELEASE_VERSION = 25.10.0
 SHELL := /bin/bash
 .SILENT: clean pull start stop
@@ -11,6 +12,8 @@ default: compose-build
 
 USER = registry.gitlab.com/openwisp/docker-openwisp
 TAG = edge
+# OPENWISP_VERSION: image tag used for pulling/pushing images (e.g. "edge", "latest", "25.10.0")
+# Can be overridden via .env or command line. Not the same as RELEASE_VERSION
 OPENWISP_VERSION ?= edge
 IMAGE_OWNER ?= openwisp
 SKIP_PULL ?= false

From 239a46614d9f1a02910fc2d095c5d17115e16a44 Mon Sep 17 00:00:00 2001
From: atif09 <mohdatif.contact@gmail.com>
Date: Thu, 26 Feb 2026 02:49:22 +0530
Subject: [PATCH 10/10] [fix/chores] Pinned RELEASE_VERSION in release target
 and clarified .env comment #554

Explicitly pass OPENWISP_VERSION= in release target and clarified which variables can be overriden via .env

Related to #554
---
 Makefile | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Makefile b/Makefile
index 94b88526..26c7dc79 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # Find documentation in README.md under
 # the heading "Makefile Options".
 
-include .env # The .env file can override variables in the Makefile, if needed
+include .env # The .env file can override ?= variables in the Makefile (e.g. OPENWISP_VERSION, IMAGE_OWNER)
 
 # RELEASE_VERSION: version string used when tagging a new release.
 RELEASE_VERSION = 25.10.0
@@ -124,5 +124,5 @@ publish:
 	done
 
 release:
-	make publish TAG=latest SKIP_TESTS=true
-	make publish TAG=$(RELEASE_VERSION) SKIP_BUILD=true SKIP_TESTS=true
+	make publish TAG=latest OPENWISP_VERSION=$(RELEASE_VERSION) SKIP_TESTS=true
+	make publish TAG=$(RELEASE_VERSION) OPENWISP_VERSION=$(RELEASE_VERSION) SKIP_BUILD=true SKIP_TESTS=true