Let's say my own Docker image is based on the Debian image and I install Apache using RUN apt-get.

When the base image gets updated, I need to remove my container and create a new one. This can be automated, e.g. with Watchtower.

But how can I keep the application inside the container (Apache in my example) up to date? The base image does not change just because a security issue in one package that is not shipped with the base image was fixed. When I create a new container with my Dockerfile, Apache is still not updated thanks to Docker's image cache.

How can I handle application updates as easy as it would be if I would install Apache on the host using the package manager?

  • why not use hub.docker.com/_/httpd instead? this way it's on docker to update your httpd... or you can rebuild your image and it's on package maintainer in that case... – alexus Jul 10 '17 at 16:00

You could use proper configuration management with systems like SaltStack, Chef, Ansible or Puppet. They allow you to preciesely manage software versions, installations, updates and do management of the actual configuration files.


The procedure is to:

  • Build new images. For steps that change, you can pass an unused build arg as a variable that changes with each build and forces the cache to be invalidated. Or you can rebuild the entire image with the --pull --no-cache options which also updates the base image.
  • Save the images in your registry if you are running this on multiple nodes (or running it on a different machine from the build server).
  • Update the running containers. With compose, you can run docker-compose pull && docker-compose up -d. With swarm, you can run the docker stack deploy -c compose.yml --with-registry-auth and it will pull the latest version from the registry as of release 17.06. If you call docker run by hand, then you'd need to call the appropriate docker pull first (to pull the image from the registry), and then delete/recreate your container.

To automate all of this, a CI-CD tool like Jenkins, GoCD, Drone.io, etc, would be used to perform all of these steps.


Run your 'docker build' with '--no-cache --pull' to make sure it always uses a fresh base image, and doesn't try to reuse cached layers for package updates.

You can set up a 'cache buster' comment halfway your Dockerfile (eg on the line where you execute the apt-get) to make sure it's always run. Eg:


RUN apt-get update && apt-get upgrade # $CACHEBUST

when building, set the buildarg to eg the current PID or $RANDOM to always build rebuild from that line:

docker --build-arg CACHEBUST=$$

or to rebuild once a day

docker --build-arg CACHEBUST=`date +%Y%m%d`
  • 1
    This helps but it is tedious if you have multiple images and applications since you always have to manually keep track of all updates as a first step. I'm looking for something that is as convenient as apt-get to keep the applications in my images up to date. – scaup Jul 10 '17 at 17:35
  • you can selectively rebuild from a certain point, updated the answer. – unilynx Jul 10 '17 at 21:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.