Let's say I'm maintaining a piece of software that I version following the semver spec. I am also maintaining a docker image for said software, tagged with version tags.
What do I do if I need to publish an updated docker image even though the underlying software hasn't change? Maybe there is a security issue in the base image I use, and I need to bump its version in all older docker images. Or perhaps there just is something wrong with the docker image itself, that I need to fix.
Let's say there's an issue with the image myapp:1.5.2. I can see a these options:
I bump the patch version of of the docker image, but not the underlying software. Suddenly the patch version numbers are out of sync - myapp:1.5.3 will be running MyApp 1.5.2.
I create a "fake" release of the underlying software, just so I have an opportunity to publish a new docker image. I now have a release of MyApp 1.5.3 that is exactly identical to MyApp 1.5.2, just that it comes in a different docker image tagged 1.5.3.
I quietly just push a new version of the image to the hub, overwriting the old myapp:1:5:2. Even though MyApp is still following semver, the docker image for MyApp is not since it's been modified after its release.
Something completely different?
What is best practice here? Does it make any difference if the Dockerfile is hosted in the same repo as the software or not?