Only while the tag is still listed in the image's library file. Docker's official-images repository says only tags in that file are built, when the file changes or when their base image updates. A tag removed from it stays on Docker Hub but is no longer maintained, so it keeps its old packages.
How rebuilds work
The official-images repository describes a library definition file for each image. Per its README, only tags listed there are built, either when the file is updated or when the base image is updated. It states plainly that only what is in the library file will be rebuilt when a base has updates.
That gives you a clear mental model. A listed tag can be rebuilt with fresh base packages, which means its digest can change while its name stays the same. A tag that has left the list is frozen. It is still pullable, and pulling it still works, which is exactly why teams miss the problem.
The silent failure
Nothing breaks when a tag stops being maintained. Your pipeline keeps pulling the same bytes. Builds stay green. The only symptom shows up in a scan, where findings on that image stop dropping because no rebuild arrives to fix them.
Per the repository, there is no formal deprecation process documented on that page. Removing a tag from the library file ends maintenance while keeping the tag available. So you cannot rely on a deprecation notice to warn you.
How to check a tag you use
- Open the Docker Hub page for the image and find your tag in the supported tags list.
- If your exact tag, or a version alias that covers it, is not listed, treat it as unmaintained.
- Compare the tag you pin with the tags the repository lists today, and plan a move to a listed one.
- Look at the date the image was last pushed. A long gap on a tag that should receive base updates is a signal to investigate.
The Hub page is the quick check, and the official-images repository is the source of truth if you want to confirm.
Moving forward without breaking things
Moving from an unlisted tag to a listed one is a version change, so test it. Run your test suite, scan the new image, and compare findings with the old one. Then pin the new digest.
If you cannot move yet, record the exception: the tag, the reason, an owner and a review date. An accepted risk with a date is a decision. The same risk with no date is drift.
Why a version alias helps and hurts
Official images encourage aliases such as a major version tag, a minor tag and a full version tag. A major alias moves forward as new releases appear, which brings patches but also behaviour changes. A full version tag moves less often. Pick the one that matches how much change you can absorb, and pin the digest either way so changes arrive when you choose.
Quick check
If an old tag still pulls, is it safe?
Not necessarily. It may be frozen. Check whether the tag is still listed as supported.
Does Docker warn me when a tag stops being maintained?
The official-images README describes no formal deprecation process, so plan to check the supported tags list yourself.
Safeguard can scan the images you run, keep an SBOM for each, and flag findings that stop improving, so a frozen tag shows up in a report instead of staying quiet. A free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
