docker-debian-artifacts | Official builds of debuerreotype-generated Debian tarballs | Continuous Deployment library

When I want to use Docker images today, I always try to find the alpine version of this image. There is reasons behind this:

Alpine Linux is a security-oriented, lightweight Linux distribution based on musl libc and busybox.

https://alpinelinux.org/

If you don't know already but you're interested in Alpine Linux, I suggest you to navigate through their website.

The good point is that this distribution is well handled by a good community. That signifies the distribution is often updated to integrate new security fixes.

It is important to understand that this is really insteresting (speaking Docker) because, as you said in your question, the built images are immutable through the time.

By using Alpine based images in Docker, you ensure that you have the latest fix from the actual known bugs/security threats. To know how often they update their Docker image, you can check this page: https://hub.docker.com/r/library/alpine/tags/

Every image based on this one will be updated at the same time, and there are many image:

• https://hub.docker.com/_/node/
• https://hub.docker.com/_/postgres/
• https://hub.docker.com/_/httpd/
• https://hub.docker.com/_/nginx/
• https://hub.docker.com/_/redis/
• https://hub.docker.com/_/memcached/
• https://hub.docker.com/_/ (the first in the list)

I don't think my solution is the best but it can help anyway:

On my servers, I created a CRON task that pull every day the Alpine image I'm using, for example node:8-alpine.

After that, whenever I build my applications based on this image, I'm sure I have the latest updates.

If you want to go deeper, you can even build you app after pulling the node:8-alpine image.

For your question about being prevent of new updates/upgrades I don't know how but I you want to use Alpine images you can subscribe to their RSS: https://alpinelinux.org/atom.xml

There are many others reasons to use Alpine images but since it'll be off topic, I'll just give you this article: https://nickjanetakis.com/blog/the-3-biggest-wins-when-using-alpine-as-a-base-docker-image

EDIT 1:

Since you have a CI environment and you build your images with, you can regularly create your own Dockerfile where you do your apt-get update && apt-get install and then use this image as a base images for your application images. But this way will add layers to your final images and then will increase its size.