Container images pushed to Dockerhub are changing checksums without changing version about docker-nginx-unprivileged

[thresheek]

Hi @fheinecke, the images are getting rebuilt on a regular cadence to pick up changes from the base images/repos fixing possible CVEs.

This also happens with Docker Official Library ones, without changing the actual tag, see the following:

• https://github.com/docker-library/faq?tab=readme-ov-file#why-does-my-security-scanner-show-that-an-image-has-cves

"These refreshed base images also means that any other image in the Official Images program that is FROM them will also be rebuilt (as described in the project README.md file)."

• https://github.com/docker-library/official-images#library-definition-files

"Tags in the library file are only built through an update to that library file or as a result of its base image being updated (ie, an image FROM debian:bookworm would be rebuilt when debian:bookworm is built)."

[thresheek]

That said, If you need to use a really specific version, you can always use the sha id of the image.

[thresheek]

Relevant discussion in nginxinc/docker-nginx#307, too.