Docker: Best way to handle security updates of packages from apt-get inside docker containers

Question

On my current server i use unattended-upgrades to automatically handle security updates. But i'm wondering what people would suggest for working inside docker containers. I have several docker containers running for each service of my app. Should i have the unattended-upgrades setup in each? Or maybe upgrade them locally and push the upgraded images up? Any other ideas?

Does anyone have any experience with this in production maybe?

Answer 1

I do updates automatically as you did (before). I currently have Stage containers and nothing in Prod, yet. But there is no harm done applying updates to each container: some redundant networking activity, perhaps, if you have multiple containers based in the same image, but harmless otherwise.

Rebuilding a container strikes me as unnecessarily time consuming and involves a more complex process.

WRT Time: The time to rebuild is added to the time needed to update so it is 'extra' time in that sense. And if you have start-up processes for your container, those have to be repeated.

WRT Complexity: On the one hand you are simply running updates with apt. On the other you are basically acting as an integration server: the more steps, the more to go wrong.

Also, the updates do not create a 'golden image' since it is easily repeatable.

And finally, since the kernel is not ever actually updated, you would not ever need to restart the container.