The neat way to re-run a layer daily is to use a build arg:
FROM debian
ARG APT_UPDATE_DATE
RUN apt-get update && apt-get upgrade -y
Re:Keeping Up with Docker Official Images
by slimslenders on Tuesday June 08, 2021 @03:49PM
(#27439898)
I came across your article on security updates when I was researching this. Thanks for writing it - it was super helpful. One of the sub goals for us is to quantify the lag that you've observed here. We're also reviewing an automated check that would flag times when an apt upgrade would be material. This is very much based on your bad arguments 1 through 4.
Cool, I would love to see some numbers! I know that some official images aren't updated for literally months (e.g. `centos`, even before the CentOS/RHEL decoupling), but others are more frequent.
Re:Keeping Up with Docker Official Images
by slimslenders on Tuesday June 08, 2021 @04:25PM
(#27440307)
will send when we've got some data. Had been wanting to reach out to you about an idea for an automated check anyway.
https://pythonspeed.com/articles/security-updates-in-docker/ has an example of a security update that was missing in the official Ubuntu base image, two weeks after Ubuntu released the updated package. I've also seen missing security updates in the Debian base images used for things like Python and OpenJDK official base images.
This means that you need to rebuild automatically yourself on a schedule (or as result of distro updates), e.g. https://pythonspeed.com/articles/docker-cache-insecure-image...