Dockerfile维护最佳实践及基础镜像标签、安全性相关疑问

Great questions! Let’s break them down one by one to help you out:

1. How to Fetch Image Tags Without Using the Docker Hub Webpage #

Tired of browsing Docker Hub to track down tags? You absolutely can retrieve them using local Docker commands—no web browser required. Here are a few reliable methods:

• Quick tag lookup with docker search
  The basic docker search command can list popular tags for an official repository. Use the filter to narrow down to official images only:

  docker search openjdk --filter=is-official=true
  

  Note: This only shows a subset of the most popular tags, not the full list.

• Comprehensive tag list with a dedicated Docker tool
  For every single tag (including multi-platform variants), use the lightweight mplatform/mquery image. It’s built specifically for this task:

  docker run --rm mplatform/mquery openjdk
  

  This will output all available tags for the openjdk repo, plus the architectures each tag supports.

• Bonus: Direct API query (if you prefer CLI tools)
  If you don’t mind using curl and jq, you can call the Docker Hub API to fetch raw tag data. Replace <repo> with your target repository:

  curl -s "https://hub.docker.com/v2/repositories/library/openjdk/tags?page_size=100" | jq '.results[].name'
  

  You’ll need jq installed to parse the JSON output into a clean list.

2. Are Official Base Images Like openjdk:8u151 Safe and Long-Lived? #

Let’s use the official openjdk repository as an example to answer this:

Safety #

Official Docker images (under the library/ namespace) are maintained by Docker in partnership with upstream projects like OpenJDK, but there’s a catch with older tags:

• openjdk:8u151 is no longer secure
  This specific patch release stopped receiving security updates years ago. It will have unpatched vulnerabilities that could expose your container to risks. Always use the latest patched tag for your desired major version—for example, openjdk:8-jdk pulls the most up-to-date 8 release, or openjdk:8u392-jdk for a specific supported patch.
• Official images follow better practices
  Compared to unofficial images, they’re less likely to contain malicious code or misconfigurations. That said, you should still scan them with tools like docker scan to catch any lingering issues.

Long-Term Availability #

Official tags are generally stable, but they’re not guaranteed to exist forever:

• Docker may periodically remove extremely old, unused tags to clean up their registry.
• Upstream project changes could lead to deprecation. For example, after OpenJDK 8 reached public end-of-life, Docker might eventually phase out some older 8 tags (though this is unlikely to happen suddenly).

If you need guaranteed long-term access to a specific image:

• Pull it locally and push a copy to your own private registry (like a Docker Hub private repo, AWS ECR, or self-hosted registry).
• Consider images from projects with longer support cycles, such as Eclipse Temurin (Adoptium), which provides extended support for OpenJDK versions.

内容的提问来源于stack exchange，提问作者atline