Discussion: How to address the use of outdated images

[frazs]

How do we determine when a container must be updated? For example, what defines an image as critically vulnerable, or unacceptably out of date?

And once we have those definitions, how should the update be enacted? Should we patch the container (with the latest version, the nearest acceptable version, or a custom variant that introduces only necessary changes)? Or treat it on an individual basis by contacting and discussing with the person or team running that container? In the latter case, we must ensure we have this contact information, but there is an upside: some out-of-date containers are no longer necessary, and the resolution could be to remove it and free the resources, something that would not be as discoverable with an automated update.

[blairdrummond]

I think this one is still live; it's more about the lifecycle management of old features. (What happens when we introduce breaking, non-backward-compatible changes)

[blairdrummond]

@Ito-Matsuda this is included in your epic right? Maybe link it in

[brendangadd]

Closing as no discussion happening on this issue, and further discussion should probably be done in StatCan/aaw#461. This issue is linked in that epic for reference.