Scenario: Mature server application from vendor running inside a Windows container. Vendor's app is built (Dockerfile) and shipped to customer (to customer's container registry via docker push ...). No vendor software updates are expected in the near future.

Question: How does the customer's ops team patch the underlying OS without direct access to vendor's source or app? Is it possible to peel-off and swap the base OS layers for a new image that can we deployed (statelessly)?

Reading this doesn't seem positive.

Edit: This is a future scenario we’re planning for; not something from the past

  • You got an image as an app distribution method, instead of a Dockerfile that employs some non-docker app distribution method?
    – kubanczyk
    May 8, 2018 at 20:57
  • @kubanczyk clarified it’s a future scenario. Standard Docker commands where the IIS app binaries are copied over and system config is tweaked via powershell towards the end of the vendor’s Dockerfile May 8, 2018 at 21:38


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy