A bot can open pull requests that move your base image to a newer tag or digest, and that is usually a good idea. Merge them through your normal checks, not blindly. Base images carry many packages at once, so one update can fix a lot or change behaviour.
Why base images matter
Container images are immutable snapshots. Docker's guidance recommends rebuilding regularly with updated dependencies to keep images current and secure. A base image you built from months ago still contains the operating system packages as they were then, with any vulnerabilities fixed since.
Docker also notes that tags are mutable: a publisher can point a tag at a new image. Pinning to a digest guarantees you get the same image, but the tradeoff is that you opt out of automatic security fixes. Pins need an updater to stay fresh, and Docker suggests a bot that opens pull requests to update tags and digests, which also provides an audit trail.
What a base image pull request changes
| Change | Effect |
|---|---|
| Newer digest, same tag | Rebuilt image with updated packages |
| Newer tag, same major | Usually small package changes |
| New major or new distribution | Possible libc, shell, certificate or package manager differences |
What to test
- Build succeeds, and the image starts.
- The health check passes in a preview environment.
- Any native libraries and certificates behave as before.
- The image size and the number of packages did not jump unexpectedly.
- A scan of the new image shows fewer, not more, findings.
The last point is easy to skip. A newer base can add a package that brings its own findings.
How to decide who approves
- Same tag, new digest on a base you trust: a good candidate for lighter review once you have a track record.
- New major base or distribution change: treat it as a migration with a named owner.
Keep the update schedule steady, weekly or similar, so the changes stay small.
Do not forget the layers above
Updating the base does not fix packages you install on top, such as language dependencies. Those need their own fix pull requests. See what to do with a vulnerability that has no fix when the base has not shipped a fix yet.
Where Safeguard fits
Safeguard can scan container images, and its autonomous remediation, which is off by default with every category on Manual, opens fix pull requests for you to review. You can try a free scan.
Try it yourself
Click through it at your own pace, or open it full screen. Look at which findings come from the base layer and which come from the application layers.
Quick check
Should I pin by digest?
Pinning gives repeatability. Pair it with a steady updater, or you freeze vulnerabilities in place.
Does a new base image always reduce findings?
Usually, but check with a scan, since new packages can bring new findings.
Sources
Last reviewed: 19 October 2026.
