[justingood]

This is exactly the conclusion we arrived at. We re-build our base images nightly (including all available updates) and then base the application images on those.