Automated RCA (incident responder) — REPEAT of incident #363 (06:02 today). Root cause unchanged: upstream regression in nginxproxy/docker-gen latest tag. At ~10:00 UTC upstream CI pushed ANOTHER master build to latest (local image 7e689bcec391). Its new digest was not in the updater failed_targets list (which stores exact digests), so the 12:42 update retried and pulled it. The build still contains the docker-entrypoint.sh regression from docker-gen PR #761: under set -eu the entrypoint probes the container command with command -v; our compose service passes a flag-style command (-notify-sighup nginx-proxy -watch ...), the probe returns non-zero, the entrypoint dies before its fallback and the container crash-loops. nginx-frontweb has no health_url, so the container-state probe failed the full 300s window (12:43:28 to 12:48:48) and the updater correctly rolled back; healthy again 12:51:11. acme-companion was the same digest that failed this morning — innocent bystander pulled alongside. CURRENT STATE: nginx-frontweb STABLE on previous images, all three containers up; no action taken on the service, diagnosis only. RECOMMENDATION: pin nginxproxy/docker-gen:0.17.2 and nginxproxy/acme-companion:2.8.1 in docker-compose.yml instead of latest — every new upstream master push mints a new digest that bypasses failed_targets, so this pull/crash/rollback cycle will repeat each 6-hourly check until pinned or fixed upstream (docker-gen PR #761 / issue #628). Optionally add a health_url for nginx-frontweb and a per-service cooldown after repeated rollbacks.