# Container image base change: pre-release checklist

Source: https://releasefailures.com/incidents/container-image-base-change/
Content version: 1.0.0
Verified on: 2026-10-22
Licence: CC BY 4.0

Definition: A base image update changes libraries or users and the service fails to start.
- [ ] PR-01 Start each rebuilt CI image on the same hosted runner infrastructure that customer jobs use and confirm a job inside it builds an image. (test class: Integration tests)
- [ ] PR-02 Before adopting a new container-in-container image tag, run a job on the hosted runners that builds an image and confirm the inner daemon starts. (test class: Integration tests)
- [ ] PR-03 Run a command inside each rebuilt image that prints the expected user account's id and fail the build when the account is missing. (test class: Configuration and environment tests)
- [ ] PR-04 Fail the image build when a generated build file meant for a single-stage image contains more than one FROM statement. (test class: Configuration and environment tests)
- [ ] PR-05 Record the base image's distribution release and packet filter backend on every build and fail when either differs from the previous build without an approved change. (test class: Configuration and environment tests)
- [ ] PR-06 Publish a rebuilt image to a small share of CI jobs first and compare its job start failure rate with the previous image before moving the shared tag. (test class: Canary and progressive delivery checks)
- [ ] PR-07 Point the latest tag at a new image only after the canary share has run without a rise in job errors for the agreed period. (test class: Canary and progressive delivery checks)