Yes the ideal is to create a new image, stop / kill / rm the old container, and spawn a new one.
One of the reasons the 1.12 swarm stuff is really cool is that if you have a service it will do a rolling update of this for you if you need to change image.
e.g.:
/ # docker service create --name srv --replicas 2 nginx:1.10-alpine
49t3535yube7lucnux7cudbyv
/ # docker service ls
ID NAME REPLICAS IMAGE COMMAND
49t3535yube7 srv 2/2 nginx:1.10-alpine
/ # docker service update --image nginx:1.10.1-alpine srv
srv
/ # docker service ls
ID NAME REPLICAS IMAGE COMMAND
49t3535yube7 srv 1/2 nginx:1.10.1-alpine
/ # docker service ls
ID NAME REPLICAS IMAGE COMMAND
49t3535yube7 srv 2/2 nginx:1.10.1-alpine
/ # docker service ps srv
ID NAME IMAGE NODE DESIRED STATE CURRENT STATE ERROR
c2oo1k3wwzqciyh41euv89usr srv.1 nginx:1.10.1-alpine ip-192-168-34-232.us-west-1.compute.internal Running Running 6 seconds ago
4n0hou4fxrdvrkyvihysm2aln \_ srv.1 nginx:1.10-alpine ip-192-168-34-238.us-west-1.compute.internal Shutdown Shutdown 9 seconds ago
64lmb9hmci32dcc1mucwp3ddt srv.2 nginx:1.10.1-alpine ip-192-168-33-185.us-west-1.compute.internal Running Running 11 seconds ago
3gq3nk9puwan4brrrpk8jddmh \_ srv.2 nginx:1.10-alpine ip-192-168-34-237.us-west-1.compute.internal Shutdown Shutdown 14 seconds ago