Think of Docker containers like lightweight, portable mini-computers that run on your actual computer (the host). Each container has everything it needs to run an application—like code, libraries, and dependencies—but it shares the host’s OS kernel rather than running a full OS itself.
Containers vs. the Host System
• Not a full OS: Containers don’t have their own separate OS but use the host’s OS kernel. They do, however, have their own filesystem and isolated environment.
• Like a sandboxed app: A container is more like a self-contained app that has just enough system components to run but doesn’t affect the rest of your system.
Keeping Containers Updated
You do need to update containers separately—updating the host system isn’t enough. Here’s why:
-
Containers use images: Containers are created from images (like templates). If the image gets outdated, the container running from it will also be outdated.
-
Rebuilding is required: You can’t “patch” a running container like a normal program. Instead, you must:
• Pull the latest version of the image (docker pull my-image:latest).
• Stop and remove the old container (docker stop my-container && docker rm my-container).
• Start a new container with the updated image (docker run -d --name my-container my-image:latest).
Automating Updates
To simplify updates:
• Use a container management tool like Docker Compose, Portianer, or Kubernetes.
• Watch for updates to base images (docker images to list images and docker pull to update).
• Set up an automated pipeline to rebuild and deploy updated containers. There are tools like Watchtower that will automate this with minimal effort.
In short: Updating the host OS won’t update your containers. You need to rebuild and restart containers with updated images to keep them secure and up-to-date.
Note for comments below: If you are trying to customize a docker image, you must build a new image. This is done through “dockerfiles” that instruct the docker engine what commands to run on a base image to create a custom image. For instance, one could take a simple Linux image like Alpine and use a docker file to install NGINX and make an NGINX image to create a reverse proxy container. In many cases you can find images that have been published that meet most basic needs so building images is often only necessary for advanced docker implementations that require special customization.
Some of this was written by ChatGPT. Good eye.