title: When does Docker image cache invalidation occur?
body: <p>Maybe my Google Foo is not strong enough, but I can't find a definite list about when Docker images in the cache are invalidated. Specifically, I'm interested at least in these scenarios:</p>
  
  <ul>
  <li>Invalidation because of <strong><a href="https://stackoverflow.com/a/26612694/371137">mtime changes</a> vs <a href="https://github.com/docker/docker/issues/880#issuecomment-47076896" rel="noreferrer">checksum changes</a></strong>. Which applies when? Can it deal with different source paths (e.g. clones of the repository in different directories)?</li>
  <li>Invalidation because of <strong>updated base images</strong>. At which point will (security) updates of e.g. Debian bubble down to me?</li>
  <li>Are there any <strong>explicit APIs</strong> that a continuous integration tool can use to tell Docker which cached images can be reused and which can't (for example because of a <code>wget foo.com/latest.gz</code>)?</li>
  </ul>