This relates to both any pulled from image, as well as packages installed by the current Dockerfile.
One issue I keep running in to is how best to maintain a Dockerfile that runs with latest package versions compared to one that has explicitly bound package versions.
The result is that my Dockerfile is generally unpinned, using latest, but that I then push particular tagged versions of specific image builds and call on those images when launching containers. The image is thus fixed, but there is probably no way I can easily and directly rebuild it from the Dockerfile. The Dockerfile build process is therefore used to update images that I may then call on explicitly.
The issue of "externalising" things/content outside of the Dockerfile is for now captured in this rule, but also in Rule 3. It should be in, but I'm unsure where it fits best.
This relates to both any pulled from image, as well as packages installed by the current Dockerfile.
One issue I keep running in to is how best to maintain a Dockerfile that runs with latest package versions compared to one that has explicitly bound package versions.
The result is that my Dockerfile is generally unpinned, using latest, but that I then push particular tagged versions of specific image builds and call on those images when launching containers. The image is thus fixed, but there is probably no way I can easily and directly rebuild it from the Dockerfile. The Dockerfile build process is therefore used to update images that I may then call on explicitly.