How to avoid an avalanche of images in Openshift when security patches keep coming in?
Get newest tag

How I mitigated it was by creating several bots. The first one uses dip to get the latest version of a specific docker image. E.g.:

go run main.go -image ubuntu -latest "xenial-\d.*"


to get the latest tag of Ubuntu Xenial. If the docker image does not exist in your local docker registry, then it will be pushed.

Update tag in several Dockerfiles

The second bot, updates the tags in the Dockerfiles. If the build is successful then it is merged. Currently an approval is always required, but if it works for a couple of months and the team has enough confidence then an auto merge can be done.

Update orchestration

The third bot updates the docker-compose.yml files, k8s files or whatever orchestration is used. If an approval is done then it will be merged into master. Again if there is enough confidence then this could be automated as well, but I always prefer some manual intervention if production is applicable. Then the team is aware that there was an update and could revert if needed. On the other hand if the monitoring works well then the team will be notified right a way and if updates are done frequently, i.e. at least once every two weeks then the team is trained and knows how to deal with this.