`r-base` (Docker Official Image) is not updated

[eitsupi]

I looked at DockerHub and noticed that r-base had not been updated and was showing a large number of vulnerabilities. I thought that updates to the base image (debian:testing) automatically triggered updates to r-base, but I guess that is not the case now?

https://hub.docker.com/_/r-base/tags

[eddelbuettel]

This may be an unfortunate side-effect from upstream r-base (which we keep identical to rocker/r-base) not wanting updates. And while "they" may rebuild, I guess we didn't.

I have other containers on cron'ed (i.e. GHA) weekly rebuilds. Maybe a good idea to add this one?

[eitsupi]

I have looked at other Docker Official Images and most of them seem to be updated frequently. https://hub.docker.com/search?image_filter=official&q=&sort=updated_at&order=desc

Perhaps we can ask the Docker Community where this difference is coming from? (I don't understand the proper place to ask this question. Maybe https://github.com/docker-library/official-images ?)

I have other containers on cron'ed (i.e. GHA) weekly rebuilds. Maybe a good idea to add this one?

I think Docker Official Images is built on DockerHub's infrastructure, so GHA can't be used.

[eddelbuettel]

Yes, sorry. Let me reword this:

• we have no input over their builds
• we PR when we have new versions of R in rocker/r-base, that is the hand-off
• they may or may not build regularly the r-base container
• our rocker/r-base is semi-independent and I guess I should turn weekly builds on

Main problem: we said for many years that rocker/r-base and r-base are the same thing :-/

[eitsupi]

Thanks, I created an issue docker-library/official-images#14191.

Main problem: we said for many years that rocker/r-base and r-base are the same thing :-/

It was obvious that the two were built from different build systems, so I think this is not a problem.

[eitsupi]

This has been fixed.