:sm70 is rebuilt by CI on every merge to candle-vllm main. The default IfNotPresent means a node with a cached copy of that tag keeps running the old binary, so a fix can be merged and deployed and still never reach the pod. The symptom is a 404 on /v1/systemone while the image tag looks correct. Always forces the pull.