Base Image updated and rebuild image but use the old base image

General
1

Hi Experters,

    I met a problem. I build image A from image B(using "FROM B:latest"). I pulled image A and generate container C on the host. Some day, the image B updated. I rebuild the image A on the other server and push to my private repository.
   On the host, I removed container C and pulled image  A again and create container D. But D still use the old image B. And on the host, there one more image B with 'none' tags. 
  After i removed the all images and pull A again, I can use the latest image B. So shall I always to remove image B, if image B updated? There would be a lot of work involed.  Is there any suggetion? Thanks!

Docker info is :
Containers: 3
Running: 3
Paused: 0
Stopped: 0
Images: 4
Server Version: 17.09.1-ce
Storage Driver: overlay2
Backing Filesystem: extfs
Supports d_type: true
Native Overlay Diff: true
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
Volume: local
Network: bridge host macvlan null overlay
Log: awslogs fluentd gcplogs gelf journald json-file logentries splunk syslog
Swarm: inactive
Runtimes: runc
Default Runtime: runc
Init Binary: docker-init
containerd version: 06b9cb35161009dcb7123345749fef02f7cea8e0
runc version: 3f2f8b84a77f73d38244dd690525642a72156c64
init version: 949e6fa
Security Options:
apparmor
seccomp
Profile: default
Kernel Version: 4.4.0-105-generic
Operating System: Ubuntu 16.04.3 LTS
OSType: linux
Architecture: x86_64
CPUs: 16
Total Memory: 62.9GiB

2

Did you explicitly docker pull B on the host running the build? If you didn’t, and there was already a B:latest tag, the build of A would have used the B that was already there; it won’t automatically try to pull it again.

I think on current Docker, with the setup you describe (container C runs image A, image A is FROM B) you will not generally see B tags in the docker images output.

If your sequence is something like this:

# initially
docker run --name C A

# elsewhere
docker pull B
docker build -t A .
docker push A

# back home
docker pull A
docker stop C; docker rm C
docker run --name D B

then in fact D will have the “old” B image; you also need to docker pull B manually.

Conventional wisdom, which I don’t know that I’ve seen explicitly stated anywhere, is to try to avoid using :latest tags for exactly this reason. This should be better now that you can dynamically specify the base image. So you can write a Dockerfile like

ARG B_TAG=latest
FROM B:${B_TAG}
...

then explicitly build

TAG=20180707
docker build --tag A:$TAG --build-arg B_TAG=$TAG .

which will produce an A:20180707 image based on B:20180707, and you can be very explicit about what versions you want to use in your deployment scripts.