Docker images are built and published to dockerhub, but releases don't stop there. Given the nature of security concerns, and ongoing patches, we need another series of builds (monthly?) Whereby the build pulls the latest build image from supported versions of a product.
The internal OS packages are update (i.e apt updates, yum updates, etc), and no other changes are made. These new images are to be published back to dockerhub using the version specifiers defined in #22, using the $EXTENSION specifier, to denote it's secure/latest/up-to-date package.