There's no easily accessible security policy

[tianon]

There's no easily accessible security policy

[yosifkit]

CVEs on applicable images are handled as quickly as fixes become available in the given distribution: https://github.com/docker-library/official-images/issues?utf8=%E2%9C%93&q=is%3Aissue+CVE. There is no specific commitment to time, since most are dependent on packagers and release processes of the various Linux distributions; for example, it takes 3-10 days to migrate from Debian unstable to testing.

Here are the PRs that include Ubuntu updates: https://github.com/docker-library/official-images/pulls?utf8=%E2%9C%93&q=is%3Apr+label%3Alibrary%2Fubuntu. Debian and Ubuntu images are updated at least once a month. We encourage maintainers of other images to provide timely updates: https://github.com/docker-library/official-images#maintainership https://github.com/docker-library/official-images#commitment.

[tianon]

Indeed, we update on a fairly regular schedule as-is, and if there is a major vulnerability, we update ASAP.