Best practice for dockerfile supported?

Question

I have a Dockerfile something like the following:

 FROM openjdk:8u151 # others here 

I have 2 questions about the base image:

1. How to get tags?

Usually I get it from dockerhub, say openjdk:8u151 , I can get it from dockerhub openjdk repository .

If I could get all the tags from any local docker command, then I would not need to visit websites to get tags, is it really a little low efficiency?

2. Will there be a secure base image?

I mean, is my base image always?

Take a look at the above openjdk repo, this is the official repo.

I found that only 8u151 left for me. But I think there should be a lot of jdk8 during the process, so there should also be a lot of jdk8 images, something like 8u101 , 8u163 , etc.

So, can I assume that the maintainer will delete some old images for openjdk ? Then if this happens, how does my Dockerfile ? Should I always change my base image if my upstream deletes the image there? Really awful for me to support that.

Even if openjdk really just generates a single jdk8 release. My puzzle still cannot be fixed since dockerhub does provide a delete button for users.

What is the best practice, please suggest, thanks.

Answer 1

How to get tags?

See " How to list all tags for a Docker image in a remote registry? "
API is enough

For example, visit:

https://registry.hub.docker.com/v2/repositories/library/java/tags/?page_size=100&page=2

Will the base image be safe?

As long as you save your own constructed image in the registry (for example, monolingual or self-sufficient), yes: you can at least create new images based on what you have done.
Or, even if the base image disappears, you still have your own layers on your own image and you can re-mark it (if the build cache is available).
See For example, Is there a way to mark the previous layer in the docker image or return a commit? "
See Disclaimers in whether it is possible to run an intermediate layer of the docker image? "