I'm trying to understand what the best way to keep running containers updated in docker. I've been participating in this discussion:


And have scripts written that help me see when a new base image is posted on hub.docker.com or when there are security updates available for the container here:


The question is, what's the "proper" way to update? I.E. should I be "apt-get upgrading" with:

docker exec MYCONTAINER bash -c 'grep security /etc/apt/sources.list > /tmp/security.list; apt-get update > /dev/null; apt-get upgrade -oDir::Etc::Sourcelist=/tmp/security.list'

And then doing docker pull when a new base-image comes out? How would the docker pull impact the updated packages? Maybe I should do the docker pull and then follow it with an apt-get upgrade?

  • Running containers should not be modified, as it opens the door for unexpected changes and drift over time. Instead, just automate your container builds and re-deploy when necessary. Put your containers behind a load balancer and it can be a zero-downtime thing. – EEAA Jun 28 '17 at 0:39
  • To be clear: containers should be immutable and stateless. Sure, you can update running containers, but that doesn't mean that you should. – EEAA Jun 28 '17 at 0:42
  • What if I'm not doing the builds? For instance when using images from docker hub and then docker-compose to start them up? Should I be doing a docker rmi IMAGE; docker-compose up to update? And, since that replaces all of the added packages, how would that differ from running apt-get upgrade and then doing the docker rmi IMAGE; docker-compose up at a later date? – Fmstrat Jun 28 '17 at 14:38
  • There seem to be several questions here, some of which have primarily opinion based answers. Can you clarify the question to be a bit more specific? – Andy Shinn Jul 2 '17 at 22:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.