Is docker inspect -f '{{.Parent}}' a safe way to get the base image ID?

Question

I want to automatically rebuild my Docker containers when their base image changed. The idea is to compare the base image ID of the current tagged container to the ID of the

Answer 1

The Parent reference does not point to the base image in the FROM line of your Dockerfile, it points to the next to last layer in your image. If your build only contains a single layer then this can be the FROM line, but adding a second line to your Dockerfile will break your scripts.

If you know the tag of your base image (this sort of meta information isn't stored in the image, so you'll need to track it externally, perhaps adding a label to your image), then you can search the docker history of the current image for your base image's current sha256. I'd use the following arguments to generate an ID list:

$ docker history --format '{{ .ID }}' --no-trunc $image_id