In working with drone I've seen several cases where pull: true is set in a step. Though it's not clear if that's needed since some steps omit it.
It is used in several examples on the drone website but not explained.
PS: I'm writing this and answering my own question because I had trouble finding to docs to explain this and wanted to make it easier for others to find.
You see pull: true a lot because the drone 0.X default was to not upgrade images. Since drone 1.0 the default is to upgrade images.
If the image does not exist in the local cache, Drone instructs Docker to pull the image automatically. You will never need to manually pull images.
If the image is tagged with :latest either explicitly or implicitly, Drone attempts to pull the newest version of the image from the remote registry, even if the image exists in the local cache.
pull: if-not-exists # only pull the image if not found in the local cache
pull: always # always pull the newest version of the image
pull: never # never pull the image and always use the image in the local cache
Drone does not automatically upgrade docker images. Example configuration to always pull the latest image when updates are available:
pipeline:
build:
image: golang:latest
pull: true
This is because reproducibility of the CI is key, and further updates could break your build. source