<p>Container base images (like Official Docker Hub images) are often updated without new tag versions. I call this Silent Rebuilds. There's no way to know this happens without image digest-checking automation like Dependabot and Renovate with specific settings. Failure to keep up-to-date is a prime source of vulnerabilities that can lead to serious security breaches. Automate the updates!</p><p>Check out the video podcast version here: <a href="https://youtu.be/z_ahbsSc4Fo">https://youtu.be/z_ahbsSc4Fo</a></p><p></p><p>🙌 The Agentic DevOps Guild has launched! It's a training + community + mentorship program for engineers wanting to learn the latest CI/CD automation and dive into Agentic DevOps. Meetups are happening now, with new course videos dropping every few weeks. Join the Guild and become your team's leader in AI for infrastructure automation <a href="https://www.bretfisher.com/theguild">https://www.bretfisher.com/theguild</a> 🍾</p><br><p><br></p><p>★Show Links★</p><ul><li><a href="https://www.bretfisher.com/waitlist">Course waitlist: GitHub Actions Pro</a></li><li><a href="https://www.bretfisher.com/blog/silent-rebuilds">https://www.bretfisher.com/blog/silent-rebuilds</a></li><li><a href="https://github.com/BretFisher/silent-rebuilds">https://github.com/BretFisher/silent-rebuilds</a></li><li><a href="https://www.bretfisher.com/chainguard-event">https://www.bretfisher.com/chainguard-event</a></li></ul><p><br><strong>Creators &amp; Guests</strong> </p><ul> <li><a href="https://podcast.bretfisher.com/people/cristi-cotovan">Cristi Cotovan</a> - Editor</li> <li><a href="https://podcast.bretfisher.com/people/bret-fisher">Bret Fisher</a> - Host</li> <li><a href="https://podcast.bretfisher.com/people/beth-fisher">Beth Fisher</a> - Producer</li> <li><a href="https://podcast.bretfisher.com/people/nirmal-mehta">Nirmal Mehta</a> - Host</li> </ul><p></p><p><strong>You can also support this podcast by subscribing to my </strong><a href="https://www.youtube.com/@BretFisher"><strong>YouTube</strong></a><strong> channel and my weekly newsletter at </strong><a href="https://bret.news/"><strong>bret.news</strong></a><strong>!</strong></p><p>Grab the best <strong>coupons</strong> for my <a href="https://www.bretfisher.com/courses"><strong>Docker and Kubernetes courses</strong></a><strong>.<br></strong>Join my cloud native <strong>DevOps community</strong> <a href="https://devops.fan/"><strong>on Discord</strong></a><strong>.<br></strong>Grab some <strong>merch</strong> at <a href="https://bretfisher.myspreadshop.com/"><strong>Bret's Loot Box</strong></a><br>Homepage <a href="https://bretfisher.com/"><strong>bretfisher.com</strong></a></p> <ul><li>(00:00) - Intro</li> <li>(05:30) - Docker Security and Image Builds</li> <li>(10:13) - CVEs in Containers</li> <li>(11:39) - Where we were</li> <li>(15:26) - Silent Builds and Mutable Tags</li> <li>(18:44) - Docker Official Image Tags Are Rebuilt Often</li> <li>(21:14) - Chainguard's Tool</li> <li>(21:34) - Tag Tracker Tool Overview</li> <li>(26:13) - High Fivers DevOps Group</li> <li>(28:16) - Problem of Silent Rebuilds</li> <li>(36:33) - Post-Stream Updates</li> </ul>

DevOps and Docker Talk: Cloud Native Interviews and Tooling

Bret Fisher

Your Images are Out of Date (probably) - The Silent Rebuilds problem

MAR 4, 202638 MIN
DevOps and Docker Talk: Cloud Native Interviews and Tooling

Your Images are Out of Date (probably) - The Silent Rebuilds problem

MAR 4, 202638 MIN

Description

Container base images (like Official Docker Hub images) are often updated without new tag versions. I call this Silent Rebuilds. There's no way to know this happens without image digest-checking automation like Dependabot and Renovate with specific settings. Failure to keep up-to-date is a prime source of vulnerabilities that can lead to serious security breaches. Automate the updates!Check out the video podcast version here: https://youtu.be/z_ahbsSc4Fo🙌 The Agentic DevOps Guild has launched! It's a training + community + mentorship program for engineers wanting to learn the latest CI/CD automation and dive into Agentic DevOps. Meetups are happening now, with new course videos dropping every few weeks. Join the Guild and become your team's leader in AI for infrastructure automation https://www.bretfisher.com/theguild 🍾★Show Links★Course waitlist: GitHub Actions Prohttps://www.bretfisher.com/blog/silent-rebuildshttps://github.com/BretFisher/silent-rebuildshttps://www.bretfisher.com/chainguard-eventCreators & Guests Cristi Cotovan - Editor Bret Fisher - Host Beth Fisher - Producer Nirmal Mehta - Host You can also support this podcast by subscribing to my YouTube channel and my weekly newsletter at bret.news!Grab the best coupons for my Docker and Kubernetes courses.Join my cloud native DevOps community on Discord.Grab some merch at Bret's Loot BoxHomepage bretfisher.com (00:00) - Intro (05:30) - Docker Security and Image Builds (10:13) - CVEs in Containers (11:39) - Where we were (15:26) - Silent Builds and Mutable Tags (18:44) - Docker Official Image Tags Are Rebuilt Often (21:14) - Chainguard's Tool (21:34) - Tag Tracker Tool Overview (26:13) - High Fivers DevOps Group (28:16) - Problem of Silent Rebuilds (36:33) - Post-Stream Updates