Do you really need all your private images to be derived directly from the upstream? Don't you start every image with: FROM foo RUN apt-get upgrade etc

Do you really need all your private images to be derived directly from the upstream? Don't you start every image with: FROM foo RUN apt-get upgrade etc ? Then why not have a set of base images, derived directly from upstream that get built every so often and have your private images be derived from that? This will not only relieve the stres on DockerHub and prevent you from having to pay the 5/month, but also give your security people a hook to run their tests and make your private images build faster, since all the system updates won't happen every time you change the code.