official-images

Perhaps we’re talking past each other? When I go to https://github.com/docker-library/official-images/blob/maste... It only is showing the newest version of node 8.16 listed in the manifest file. In other words, if I had an image based off node 8.15, it isn’t going to be updated ever. So it’s not a matter of just rebuilding regularly, if you aren’t updating your dockerfiles to use newer language versions, you also aren’t going to get system updates. Edit: I think i do see your point which is that if you are completely up to date on language versions, clearing the build cache every once in a while may still help get a system update if an upstream image is changed in between the release of a new language tag.

This is how the official images work. https://github.com/docker-library/official-images/tree/maste... Each image has a manifest with all the source repos, tags, what commit to pull from, what arches are supported, etc. As long as the tag is listed in that manifest, it is automatically rebuilt when the base image changes.

> As of RIGHT NOW, haproxy has not updated it's official docker image and has 6 day old docker images which docker hub flags as having vulnerabilities (screenshot at https://imgur.com/a/SiYoZzc). So I'm a little hesitant at calling this release "Cloud Native" 1. The “official” Docker image is not maintained by HAProxy itself. “Official” refers to being blessed by Docker. See: https://github.com/docker-library/official-images#what-do-yo... 2. The vulnerability scan of Docker Hub is bogus: https://github.com/docker-library/faq#why-does-my-security-s... 3. There's a pull request created by me to switch from 2.0-rc to 2.0: https://github.com/docker-library/haproxy/pull/89. I created it immediately after learning about the release. Any further delay is caused by the Docker Official Images team. Disclosure: I'm a community contributor to HAProx

https://github.com/docker-library/official-images/pull/5516 The official image was also affected, too, it appears.

3.8 looks fine? » docker run --rm -ti alpine:3.8 sh -c 'cat /etc/shadow | grep root' root:!::0::::: The others you mention though, I agree, they look less than fine. Also, has anyone reported this to the official Alpine repository? (since the Talos disclosure seems to be confused; it says official but has URLs to the Glider Labs version?) Edit: Ah, so here's the relevant GitHub issue for official Alpine Linux docker: https://github.com/docker-library/official-images/pull/5516 <=3.5 is no longer supported. Everything newer is patched.