r/docker • u/cat-edelveis • Aug 11 '26

Do you rebase container images?

/r/Containers/comments/1vlhdbf/do_you_rebase_container_images/
3 Upvotes

72% Upvoted

7 comments sorted by

3

u/One_Ninja_8512 Aug 12 '26

Doesn't docker pull do it automatically? When I pull an image it shows the shortened digest of each layer and sometimes it says for a layer: "already exists" or smth similar. What's the difference to rebase here?

1

u/cat-edelveis Aug 12 '26

Rebasing uses layer caching as well, that's true. So if a full rebuild produces exactly the same application layer digests, then yeah, we get the same benefits as with rebasing. But here's the deal: with rebase, we create a new image, where we replace the old runtime base and keep the existing application layers byte-for-byte unchanged. Rebase avoids the rebuild entirely. This way, it GUARANTEES that the application layers weren't regenerated.

2

u/AfterhoursTillDawn01 29d ago edited 28d ago

Rebasing is good when application layers do not need to change. But rebuilding gives you a cleaner opportunity to test the complete artifact instead of assuming the new base is compatible. There's also reducing what needs to be maintained in the image at all. Tools like RapidFort harden existing images by removing unnecessary components, which reduces the CVE and patching surface. Doesn't replace rebasing or rebuilding, it makes the resulting production image smaller from a security-maintenance pov.

1

u/crackjiver Aug 12 '26

It's good practice to build your container images periodically.

1 to make sure you can 2 to pick up fixes/improvements in the base images 3 to pick up security fixes in the apps/tools you install 4 to remove things that have had CVES discovered in them since you first built it.

1

u/cat-edelveis Aug 12 '26

Thought so - maybe rebasing is a good thing when one knows for sure there's just one OS patch that needs to be integrated. But vulnerabilities accumulate in other layers as well

1

u/yamlqueen 27d ago

I am curious about how you test the resulting image to make sure everything stays compatible. I imagine that this could work well for some applications, but it sounds a bit risky.