Say I have a trivial container based on the ubuntu:latest. Now there is a security update and ubuntu:latest is updated in the docker repo .
ubuntu:latest
A simple and great solution is shepherd