Free · online · verified
Auto-fixed CVE container images
An auto-fixed CVE image is rebuilt for you whenever a fix for one of its known vulnerabilities is released. Paste any Docker or OCI image into OCImend and turn on watching: it is rescanned as new CVEs are published, and when the distribution ships fixed packages the CVE-fixed image is rebuilt, rescanned, run-tested next to the original and published at ocimend.io. Free, online, no sign-up.
Watch and auto-fix my image → Browse the registry
Why OCImend
Fixed the day the fix ships
Images are re-checked as fixes are published; a new fix means a new CVE-fixed build, with no ticket and no rebuild on your side.
Verified every time
Each automatic build is rescanned and started side by side with the original before it replaces the previous one.
Pinned and traceable
Every build has its own digest, before/after report and signature: promote it by digest, roll back to any earlier one.
Into your pipeline
Pull the latest from ocimend.io, let Renovate or Dependabot propose the new digest, or open a pull request with the fix to the image's source.
Ready to pull
| Image | Pull | Known CVEs before → after | Built |
|---|---|---|---|
| debian from mirror.gcr.io/library/debian:bookworm-20240513 | docker pull ocimend.io/debian:bookworm-20240513-fixed | 54 → 48 | 2026-10-13 |
| python from mirror.gcr.io/library/python:3.14.0rc3-alpine3.21 | docker pull ocimend.io/python:3.14.0rc3-alpine3.21-fixed | 90 → 0 | 2026-10-12 |
| ruby from mirror.gcr.io/library/ruby:4.0.7-alpine | docker pull ocimend.io/ruby:4.0.7-alpine-fixed | 1 → 0 | 2026-10-11 |
| wordpress from mirror.gcr.io/library/wordpress:cli-2.12.0-php8.3 | docker pull ocimend.io/wordpress:cli-2.12.0-php8.3-fixed | 4 → 1 | 2026-10-11 |
| redis from mirror.gcr.io/library/redis:4-alpine3.11 | docker pull ocimend.io/redis:4-alpine3.11-fixed | 43 → 0 | 2026-10-11 |
| node from mirror.gcr.io/library/node:26.11-alpine3.23 | docker pull ocimend.io/node:26.11-alpine3.23-fixed | 13 → 12 | 2026-10-11 |
| caddy from mirror.gcr.io/library/caddy:2.11.7-builder-alpine | docker pull ocimend.io/caddy:2.11.7-builder-alpine-fixed | 22 → 21 | 2026-10-10 |
| rabbitmq from mirror.gcr.io/library/rabbitmq:4.3-alpine | docker pull ocimend.io/rabbitmq:4.3-alpine-fixed | 1 → 0 | 2026-10-10 |
| golang from mirror.gcr.io/library/golang:1.27.2-alpine3.24 | docker pull ocimend.io/golang:1.27.2-alpine3.24-fixed | 1 → 0 | 2026-10-10 |
| traefik from mirror.gcr.io/library/traefik:v3.7.14 | docker pull ocimend.io/traefik:v3.7.14-fixed | 1 → 0 | 2026-10-08 |
| haproxy from mirror.gcr.io/library/haproxy:1.7-alpine | docker pull ocimend.io/haproxy:1.7-alpine-fixed | 6 → 0 | 2026-10-08 |
| httpd from mirror.gcr.io/library/httpd:2.4.69-alpine | docker pull ocimend.io/httpd:2.4.69-alpine-fixed | 3 → 2 | 2026-10-07 |
| nginx from mirror.gcr.io/library/nginx:1.31.6-alpine3.24-otel | docker pull ocimend.io/nginx:1.31.6-alpine3.24-otel-fixed | 3 → 0 | 2026-10-06 |
| ubuntu from mirror.gcr.io/library/ubuntu:questing-20250830 | docker pull ocimend.io/ubuntu:questing-20250830-fixed | 206 → 113 | 2026-10-05 |
| php from mirror.gcr.io/library/php:8.5.10-cli-alpine3.24 | docker pull ocimend.io/php:8.5.10-cli-alpine3.24-fixed | 1 → 0 | 2026-10-05 |
| eclipse-temurin from mirror.gcr.io/library/eclipse-temurin:25.0.4_7-jre-alpine | docker pull ocimend.io/eclipse-temurin:25.0.4_7-jre-alpine-fixed | 1 → 0 | 2026-10-05 |
| mongo from mirror.gcr.io/library/mongo:bionic | docker pull ocimend.io/mongo:bionic-fixed | 282 → 120 | 2026-10-01 |
| alpine from mirror.gcr.io/library/alpine:3.17.7 | docker pull ocimend.io/alpine:3.17.7-fixed | 20 → 0 | 2026-10-01 |
| elasticsearch from mirror.gcr.io/library/elasticsearch:8.13.0 | docker pull ocimend.io/elasticsearch:8.13.0-fixed | 160 → 147 | 2026-10-01 |
| mariadb from mirror.gcr.io/library/mariadb:10.6.16 | docker pull ocimend.io/mariadb:10.6.16-fixed | 190 → 165 | 2026-09-29 |
| registry.access.redhat.com/ubi9/ubi-minimal from registry.access.redhat.com/ubi9/ubi-minimal:latest | docker pull ocimend.io/registry.access.redhat.com/ubi9/ubi-minimal:latest-fixed | 1 → 0 | 2026-09-27 |
| postgres from mirror.gcr.io/library/postgres:16.12-alpine3.22 | docker pull ocimend.io/postgres:16.12-alpine3.22-fixed | 123 → 46 | 2026-09-27 |
| mysql from mirror.gcr.io/library/mysql:8.0.17 | docker pull ocimend.io/mysql:8.0.17-fixed | 67 → 0 | 2026-09-27 |
Questions
How is this different from a scanner?
Will an automatic build break my app?
Is it free?
Can my CI use it?
Also on OCImend
CVE-free images · FIPS-enabled images · Free online CVE fix · Hardened images · Image CVE reports · Guides · For platform teams