I run this periodically from a little shell script; I "should" automate it, but time is scarce.

  ⟩ cat ~/bin/icloud_download
  #!/bin/bash
  mkdir "$(pwd)"/{photos,cookies} 2> /dev/null
  
  if [[ -z "${ICLOUD_USERNAME}" ]]; then
      echo "need env ICLOUD_USERNAME"
      exit 1
  fi
  if [[ -z "${ICLOUD_PASSWORD}" ]]; then
      echo "need env ICLOUD_PASSWORD"
      exit 1
  fi
  
  podman container run -it --rm --name icloud \
      -v $(pwd)/photos:/data \
      -v $(pwd)/cookies:/cookies \
      -e TZ=America/Boise \
      icloudpd/icloudpd:latest \
      icloudpd --directory /data \
      --cookie-directory /cookies \
      --folder-structure {:%Y/%Y-%m-%d} \
      --username "${ICLOUD_USERNAME}" \
      --password "${ICLOUD_PASSWORD}" \
      --size original

> icloudpd/icloudpd:latest

Passing your raw iCloud creds into the unverified latest tag is fine until it’s not. Better to pin to a specific tag or hash.

You're not wrong. I know I need to put more work into it. Just haven't had time.

I'm "protected" by the fact Podman doesn't automatically update the latest image even when using the latest tag.

I was more showing how simple icloudpd is to use.