Because the Docker registry works by accumulating everything checked in ever, I think we probably _don't_ want to build and push new base images (even as part of the periodic updates proposal).
Instead, I suggest that we produce one base image in koji at release time, and have rel-eng push that, and then use Docker's "trusted builds" process to produce updated layers.
Does this make sense?