Skip to Content

How old are Docker Official Images?

TL;DR

CentOS base images sucks! They’re old, not updated for months!

As a professional DevOps I concern about a lot of things… but security is always close to the top of the list. With Docker build environments and deployments became much more stable, which often is a result of just being stale ;/

I’ve been talking about this for long time but it’s still hard for people to believe it. Let’s check then few, most popular images and when were they last time updated. I wrote a script for that, so feel free to check your list:

Results show that not all images are frequently updated and if we get a little bit deeper and check how many packages require upgrade:

ImageCreation dateAge (in days)Packages to upgrade
centos:72020-11-14T00:20:04.644613188Z7516
centos:82020-12-08T00:22:53.076477777Z5112
debian:92021-01-12T00:35:06.08981705Z160
debian:102021-01-12T00:32:37.071722022Z160
ubuntu:18.042021-01-21T03:38:05.801776526Z72
ubuntu:20.042021-01-21T03:38:23.37559427Z74
alpine:3.112020-12-17T00:19:49.284211148Z420
alpine:3.122020-12-17T00:19:42.11518025Z420
alpine:3.132021-01-15T02:23:51.238454884Z135
node:102021-01-27T20:32:54.257201224Z013
node:122021-01-12T10:36:27.349274428Z1513
node:142021-01-12T10:33:48.195283512Z1513
node:152021-01-27T20:29:39.779176105Z013
openjdk:82021-01-21T02:40:05.312239007Z70
openjdk:112021-01-21T02:38:20.819671373Z70
openjdk:152021-01-20T00:45:36.664060993Z8?

Personally, I consider running yum upgrade or apt upgrade/apt dist-upgrade in Dockerfile as anti-pattern - instead builds should be running so frequently to automatically pull all new upgrades from base images. That’s theory, but with images like CentOS, you have to do it or risk running your software on unpatched and potentially unsecure system. That’s why I don’t like CentOS images as a base in general, they just suck from this perspective.

There’s also another issue here - running those upgrades makes your image just bigger. Sometimes significantly bigger. That’s not what I expect from base images

comments powered by Disqus