While everyone talks about using Docker in production, and that you should have a real pipepline implemented to build all your images, they barely show you the plumbing required in practice. This talk dives into the pipeline we've put together at REWE Digital to cater our own developers writing microservices in Java, Scala, Go and node.js. After the first huge frenzy about enabling everyone to build software and deploy it in a container, so that they decide what's in the container, you soon realize that you solved the "shipping an application" issue. But now you've to consider how to update your docker base images. Wait, you've a base image right? Or did every team just pick one from Docker Hub on their own? Once you've sorted that out the inevitable question is: how do we regularly update those base images? This talk dives into the issues we've found and what our current base image build process and lifecycle looks like. It's the ugly truth about chaining Jenkins, docker and container-diff all together and why we moved from Alpine to Debian based images.