Image version number

[tomasrudh]

I wonder what the policy is for changing the version number? The reason I ask is that I have seen that perl-base 5.36.0-7+deb12u1 in the image python:3.13.3-slim has a vulnerability, so I thought I should fix that. It turns out that when I download the image now is the version bumped to perl-base 5.36.0-7+deb12u2, but the image version is still python:3.13.3-slim. Is this to be expected? Or have I missed something?

[tianon]

See docker-library/official-images#12277 (comment) for a clarification that I think might be helpful here (and docker-library/cassandra#288 (comment), which I just commented, which might also be related/helpful).

In short, "3.13.3" in python:3.13.3-slim will always refer to Python version 3.13.3, and no part of that is the "image version" -- we don't actually maintain a "version number" for the image, but there is a unique content digest for every built/pushed image.

We do often maintain additional tags/aliases for being more specific about what's underneath Python, such as python:3.13.3-slim-bookworm vs python:3.13.3-slim-bullseye (which are two different major releases of Debian that are currently supported).

[tomasrudh]

I see, thanks for the explanation. I am just surprised that two images with the same version number can have different content. I understand that Python itself is the same, but maybe there could be some indication that something else in the image has changed.

[tianon]

The content-addressable digest being different is the indication that something has changed. 😅

(There are also some annotations that might be interesting/useful which show some change: https://oci.dag.dev/?image=python:3.13.3-slim)

As noted in docker-library/official-images#12277 (comment), we also maintain https://github.com/docker-library/repo-info which can help to surface "what changed?" for a given tag and the digests of the old content in case you need it for whatever reason; in the case of python:3.13.3-slim, that'd be https://github.com/docker-library/repo-info/blob/master/repos/python/remote/3.13.3-slim.md -> https://github.com/docker-library/repo-info/commits/master/repos/python/remote/3.13.3-slim.md

In docker-library/repo-info@5225368#diff-9fffab04ecfa68b022c209b70490b52068128b0152a3f3a5124265b42c9454d2, you can see that this changes all the layers, so it's most likely just a base image update (which can also be seen in https://github.com/docker-library/official-images/issues?q=label%3Alibrary%2Fdebian -> docker-library/official-images#18947).