docker-create mechanism for verifying security on pinned versions

[jessb0t]

No description provided.

[F-said]

Contentious discussion regarding whether it a best practice to version-pin tools or not.

Docker itself says to it could potentially reduce errors, as the vision of docker is to have "frozen" containers that regularly get updated, while users of docker claim that it is unreliable to rely on container maintainers to maintain security.

So a good middle-ground is to listen to docker docs on best-practices, but create automated tools to fill-in any gaps when it comes to managing complexity.