microsoft/go-images started out more complex than it is now, and with less certainty about what we would be supporting. Now, I think adding logic to dockerupdate to assign preferredMinor/preferredMajor to point at the N-1 build would make sense.

This logic could also potentially handle cleanup of old images, because when preferred* changes, that indicates that a new release came out.