Rebuild images regularly to pick up security patches

An image is frozen at build time. If you build once and deploy that image for a year, it keeps every vulnerability fixed upstream since then, even though nothing in your code changed.

Docker recommends rebuilding often:

• --pull fetches the newest version of the base image.
• --no-cache makes every step run fresh, so package installs pick up patches too.

A scheduled CI job (weekly is common) that rebuilds and rescans your main images keeps them current even when the app code has not changed.

A passing scan is a snapshot, not a permanent result. Rebuild and rescan on a schedule to keep it true.

docker build --pull --no-cache -t my-app:1.4.1 .