CVE-2015-7547 affects glibc, which is present in pretty nearly all docker containers. There's an automated process underway which will update all official containers, but it's not immediately clear how I should manage the situation.
Some third party containers are poorly maintained, and likely not to get rebuilt any time soon. We have local containers that need work to get re-builds done, often not more complicated than rebasing them on a newer upstream base container. The speed of those upstream containers getting rebuilt will be quite variable. If I rebuild everything locally now, I'll be too early to get the fix in some cases. In general the 'everything's just a container' promise of docker administration doesn't hold here.
So, what strategies are available?
One thing that would be really useful would be to be able to
docker exec something in each container to check if it's vulnerable. Something which directly tests for the vulnerability would be ideal, but failing that some tool which knows enough about the packaging systems of all sorts of different linux distributions would also be helpful. Is such a tool available that will run in the diverse range of (often minimal) docker containers?
Any other ideas?