How to fix container image CVEs automatically

OCImend · 2026-09-26

Short answer

To fix container CVEs automatically, rebuild the image with its own package manager's upgrades for exactly the vulnerable packages, as one new layer, then rescan it and start it to confirm it is better and still works. Watch the image so the rebuild repeats when the distribution publishes new fixes.

Illustrative: CVEs before and after a package-upgrade rebuild

original

-fixed

The loop

01Scanwhich packages have fixes
02Upgradeapt / apk / dnf, sandboxed
03Rescanfewer CVEs, none new
04Smoke teststarts like the original
05Watchrepeat when fixes land

What an automatic fix can and cannot do

Finding	Automatic fix	Why
OS package with a fixed version	yes	the package manager upgrades it
OS package, no fix yet	later	watch: rebuilt when the distribution ships it
Go / npm / pip dependency	no	needs a rebuild from source; the report lists the version
End-of-life base	no	move to a supported base; alternatives are measured

Why a gate matters

An upgrade can pull in a new vulnerable dependency or break start-up. A fix is only useful if it is measured: fewer known CVEs, none introduced, and the container still starts.

Fix an image →

Questions

Does fixing change my application?

No. Only OS packages are upgraded, as one new layer. Entrypoint, user, environment and application files stay as they were.

What if no fix is available?

Watch the image: it is re-checked daily and the fixed image is rebuilt when the distribution ships a fix. Meanwhile a slimmer base often removes most findings.

Is it safe to run untrusted images for testing?

OCImend runs them only inside gVisor sandboxes, without network for tests.

Sources

Debian security tracker triage