Incidentally, I've proposed official image annotations[0] that would let an image tell you what its base image is, both by immutable digest and by mutable tag,

Incidentally, I've proposed official image annotations[0] that would let an image tell you what its base image is, both by immutable digest and by mutable tag, so you could detect this drift automatically. Automated tooling could look at these annotations and notify maintainers, or proactively rebuild/rebase when base images change[1]. By having this information on the images themselves, you don't have to deal with as much source repo churn, though you might want that too. If your app layers have a strong enough contract with your base layers (buildpacks is really good for this!), then you can rebase[2] instead of rebuilding from source. [0] OCI spec proposal: https://github.com/opencontainers/image-spec/pull/822 https://github.com/opencontainers/image-spec/pull/822 [1] Proof of concept in the `crane` tool: https://github.com/google/go-containerregistry/pull/960 https://github.com/google/go-containerregistry/pull/960 [2] https://github.com/google/go-containerregistry/blob/main/cmd/crane/rebase.md https://github.com/google/go-containerregistry/blob/main/cmd...