Docker / Images, Dockerfiles & Build Reliability
Review base-image refresh independently from application source changes
A rebuild can reuse an older base locally even when application sources are unchanged. Release provenance should identify the actual base digest.
Environment and inputs: Docker Engine · Compose v2 and Buildx where specified; Linux containers unless noted. Verify daemon context, installed feature support and authorized host or Swarm manager access first.
Start with this check
Confirm the environment and replace sample objects, namespaces, images, paths and hosts with approved targets. Share only relevant, sanitized output. Follow the workload owner’s process for changes.
docker image inspect --format '{{json .RepoDigests}} {{.Created}}' base:approvedRead the result
This reads local metadata for the illustrative base reference. Creation time alone is not a vulnerability status or proof that the remote tag has not moved.
Resolve and verify
Compare the approved base digest and patch process with build logs and final artifact provenance. Rebuild and validate through the supported release pipeline when a refresh is required.
Before changing production
Do not switch to an unpinned unreviewed base merely because its tag says latest.