[atomic] keeping Atomic Registry up-to-date for security?

[Ken Dreyer <kdreyer redhat com>]

When I have an Atomic Registry running in production, what is the best
way to keep the whole thing up-to-date for security fixes?

For example, I can use yum-cron to automatically download and install
RPM updates on a traditional system.

Should I do the following:

  docker pull openshift/origin-docker-registry
  docker pull openshift/origin
  docker pull cockpit/kubernetes

... and then restart the systemd services if any of those has an update?

- Ken