[justingood]

We tend to handle that part inhouse. We're using Jenkins and have it set up to build a standard set of base images with all the latest updates daily. It can be run on-demand as well.

All containers running code are based on these images, so the updates are picked up on the next build/deploy.