Docker image "Created" date

[jlherren]

I'm a bit confused about the "Created" field of the docker image. For example, tag 5.2.2-apache shows "Last published 5 days ago". But if I pull this image and check it locally, it looks much older:

~ docker image ls --filter reference=phpmyadmin:5.2.2-apache
REPOSITORY   TAG            IMAGE ID       CREATED        SIZE
phpmyadmin   5.2.2-apache   2d9a07a01a58   7 months ago   568MB
~ docker image inspect phpmyadmin:5.2.2-apache
[...]
        "Created": "2025-02-01T20:29:24Z",
[...]
                "PHP_VERSION=8.2.29",
[...]

The image seems to be dated 2025-02-01, but clearly it's newer, since PHP 8.2.29 was released on 2025-07-03. Is the "Created" field kept at an old date on purpose or is this a bug? Or what am I missing?

The reason I ask is because my monitoring system now reports old images running in containers, and phpmyadmin keeps getting reported.

Thank you for any insight!

[ibennetch]

I suspect that what's happening is Docker automatically builds new images whenever there's a dependency or base layer (I'm not sure what the proper terminology here is) that updates, but our top layer doesn't update as often. I think you're seeing the "Last published" from when the image was most recently built, but the "Created" date shows when the phpMyAdmin image was last built.

I'm not sure if there's a good solution (other than forcing a new image every time we notice a lower layer image that updates, but I'm not sure if that's really going to solve anything).

I don't have an immediate solution, but I think that's what is causing this behavior.

[jlherren]

Thank you for the explanation. Indeed that date is not long after the release of phpmyadmin 5.2.2.

It's still a bit unclear to me how the whole image can have an old creation date, when the base image it depends on has changed. My limited understanding of docker is that when a base image changes, the child image is rebuilt, which causes a fresh creation date. But perhaps I misunderstand the build process and phpmyadmin is somehow "grafted" on top of php:8.2-apache. If I have some time I'll try to look at the build scripts to get a better understanding.

[williamdes]

I'm not sure if there's a good solution (other than forcing a new image every time we notice a lower layer image that updates, but I'm not sure if that's really going to solve anything).

As far as I know it's automatically re built.

@tianon can you give us more insights on this technical question?

[ibennetch]

As far as I know it's automatically re built.

Yes, the image is rebuilt automatically, but if we were to re-tag what's essentially the same existing commits on our end, the date might update. I don't really like that option anyway.

I wonder what tool is reporting a problem and if it's possible to work with the vendor for a solution on their end.

[williamdes]

As far as I know it's automatically re built.

Yes, the image is rebuilt automatically, but if we were to re-tag what's essentially the same existing commits on our end, the date might update. I don't really like that option anyway.

I wonder what tool is reporting a problem and if it's possible to work with the vendor for a solution on their end.

There is building in this repository for the old image that is phpmyadmin/phpmyadmin
Like you said unless we are re-tag it there is no updates done
and there is the official phpMyAdmin image, that seems to have re builds done automatically.
but maybe only for the latest tags we pushed to the manifest.

There is something in the automations of https://doi-janky.infosiftr.net/job/repo-info/job/local/job/phpmyadmin/ and other jobs that do the magic updates

[tianon]

We do perform automated rebuilds of the image any time the base images are updated.

As for the timestamp, see docker-library/httpd#266 (comment):

We set SOURCE_DATE_EPOCH (buildkit docs) while building -- if you want to see the date the build was performed, you'll want to look at the org.opencontainers.image.created annotation we add in the image index (relevant code) instead: https://oci.dag.dev/?image=httpd:2.4-alpine ("org.opencontainers.image.created": "2024-09-06T23:20:57Z").

If you look at https://oci.dag.dev/?image=phpmyadmin right now, you'll see "org.opencontainers.image.created": "2025-09-08T21:51:50Z" for the amd64 images. 👍

The Jenkins job you've linked is responsible for updating https://github.com/docker-library/repo-info/tree/master/repos/phpmyadmin, which tracks changes and updates to the images over time. 👀

[williamdes]

Thank you !

[jlherren]

Ah, so the date is explicitly set, that explains it, thank you very much all for explaining!

I wonder what tool is reporting a problem and if it's possible to work with the vendor for a solution on their end.

It's a simple shell script that extracts the create date of images currently used in running containers and feeds it into Prometheus / Alertmanager.

I'll figure out a solution. Unfortunately, org.opencontainers.image.created doesn't seem available through docker image inspect (which is weird, because other similar tags are available).