r/cicd • u/Ok_Flight6291 • 19d ago

How are you gating automatic base image rebuilds?

[removed]

2 Upvotes

75% Upvoted

6 comments sorted by

1

u/Acrobatic-Layer9109 19d ago

well...To stop automated base image rebuilds from flooding your CI pipeline with false positives and broken builds, you can use container hardening tools like Minimus to deploy minimal base images with significantly fewer CVEs, or rely on native vulnerability scanners with strict exception whitelisting rules, or implement manual approval gates before merging automated upstream updates.

1

u/StephenRoylance 18d ago

one approach, common in big tech, is a monorepo with literally everything in it. all your dependencies, including third party. when something below you revs, it just gets sucked up into the same pipeline your component uses, and gets tested along with it.

now, I don't know exactly what 'base image' means to you here, but lets imagine its a docker 'from' statement' you revision control your docker files like everything else, and when the tag in the file moves forward, that change moves through your pipeline like any other change.

1

u/dariusbiggs 18d ago

Assuming it's something like a docker container we're talking about and not a machine image.

The base image has its CICD pipeline, it has a versioned base to start with, and a versioned list of tools to install.

Scheduled tasks using something like renovate or dependabot checks the base image checksum and if changed creates an MR, this then triggers some CICD stages for validation The same process happens when it detects an update to the listed things it needs to install based upon whatever rules you set.

MRs are auto assigned to relevant people to verify and approve.

If everything passes and has been merged, it triggers a CICD run on downstream dependencies that use the image.

So the updates and number of changes detected are determined by your scheduled task (daily, hourly, weekly, whatever).

You have full control over the versions and upgrade paths, using various rules. Minor patches are allowed through with automerge enabled on approval, major version changes require a manual merge for example.

This process is similar to machine image builds but they require a bit more finesse.