Well, apart from "6) Don’t use only the “latest” tag". If I'm not using latest, and I don't know that the Apache and Nginx images have been updated, then it's

Well, apart from "6) Don’t use only the “latest” tag". If I'm not using latest, and I don't know that the Apache and Nginx images have been updated, then it's very likely that "yum update" might do something.