[mfontani]

I keep track of upstream image changes using https://github.com/crazy-max/diun

... but I also separately ensure all software installed in a docker image is pinned to a version, and have a process I run daily to check whether the upstream packages versions have changed, in which case I rebuild the images which then get the updated (possibly security) version.

It's fiddly, and a lot of bash and perl. I'd welcome a similarly trust-able tooling from a reputable source.

[slimslenders]

Feel free to get in touch if you want to try out our tool. The support for pinning versions in run layers is just being released but happy to send you a breakdown of how that works.