We only build images on versions that still get security fixes from their maintainers.

These versions are built and rebuilt every week.

Not every combination is built. Each Ansible version only ships with the Python versions it supports. See ansible-versions.yml for the full list.

We keep building a version while both of these are true:

1. Its maintainer still releases security fixes for it.
2. The official Python image still publishes updates for it.

If either one stops, we stop building that version.

• We remove it from our builds.
• Old tags are not deleted. You can still pull them, so you have time to upgrade.
• Old tags do not get security fixes. They are frozen as they were on their last build.
• Move to a supported version as soon as you can.

Production images are rebuilt every Tuesday at 04:00 UTC. Each rebuild picks up the latest patches for:

• Ansible (latest patch release)
• Python
• The base operating system

Do not open a public issue or pull request. It could expose the problem before it is fixed.

Use GitHub's private vulnerability reporting instead. Please include:

• The image tag or digest (for example, serversideup/ansible:14-alpine3.24@sha256:...)
• Steps to reproduce the problem
• What an attacker could do with it

Problems in things we write and ship:

• Scripts in src/, like the entrypoint and helper scripts
• Default settings, users, and file permissions in the image
• Our build and publish workflows

Problems in software we package but do not maintain:

If a fix is already released upstream, you don't need to report it to us. Our weekly rebuild will pick it up.