DevOps and Docker Talk: Cloud Native Interviews and Tooling

Your Images are Out of Date (probably) - The Silent Rebuilds problem

4 snips
Mar 4, 2026
They dig into silent rebuilds: how container base images are rebuilt without tag changes and why mutable tags hide those updates. They explore tools and automation for digest-checking like Dependabot, Renovate, Tag Tracker, and Chainguard. They discuss pinning digests for consistency and workflows to detect and respond to unseen image changes.
Ask episode
AI Snips
Chapters
Transcript
Episode notes
INSIGHT

Base Images Accumulate CVEs Over Time

  • Container base images age and accumulate CVEs after deployment even if clean on day one.
  • Bret Fisher highlights that upstream base images (Debian/Alpine/etc.) introduce new vulnerabilities over time as CVEs are discovered and patched upstream.
ADVICE

Automate Digest Checking Daily

  • Automate detection of changed image digests using tools like Dependabot, Renovate, or ChainGuard's Digestabot.
  • Bret recommends configuring these tools to check daily so silent rebuilds produce PRs you can review and deploy.
INSIGHT

Official Image Tags Are Mutable

  • Docker Hub official image tags are mutable and can be rebuilt to a new digest without changing the human-readable tag.
  • Bret Fisher explains tags can be rebuilt when underlying OS or dependencies change, causing different image digests for the same tag.
Get the Snipd Podcast app to discover more snips from this episode
Get the app