title: Making sure the "platform" part of a 3rd party image from DockerHub is up-to-date
body: <p>I would like to use <strong>other peoples</strong> images from DockerHub. I trust the applications that the containers are for and I trust the maintainers to update the DockerHub image if their application gets an update. I however do not trust them to <code>docker build --pull</code> every time the baseimage they use gets an update (for example when they use <code>FROM debian:bullseye-slim</code> in their Dockerfile).</p>
  <p>What I want: to check continuously that everything (including the &quot;platform&quot; aka the Debian baseimage in this example) is up to date without building everything myself (if possible).</p>
  <p>My main problem: There seems to be no way to check a base image from a pulled docker image (see <a href="https://stackoverflow.com/questions/35310212/docker-missing-layer-ids-in-output/35312577#35312577">Docker missing layer IDs in output</a> and other stackexchange questions about the same thing). Therefore I cannot automatically and generally compare the layers of the image from my running container with the upstream baseimage (or even the date of the last update of the application image with that of the baseimage).</p>
  <p>Is there a way to do what I described above? Or do I really have to</p>
  <p>a) fully trust the maintainer of the DockerHub image to have their build pipeline in check or</p>
  <p>b) build everything myself (in which case: why would there even exist a DockerHub instead of a <em>DockerFile</em>-Hub)?</p>
  <p>If that may be relevant: This is sort of a extension of this older question: <a href="https://serverfault.com/questions/611082/how-to-handle-security-updates-within-docker-containers">https://serverfault.com/questions/611082/how-to-handle-security-updates-within-docker-containers</a></p>