Container Image Patching

Patch container CVEs surgically. Upgrade only packages that Trivy reports as HIGH/CRITICAL with available fixes; avoid broad distro upgrades or unnecessary base-image changes.

When to Use

Use for Dockerfile or image inputs when reducing Trivy-reported HIGH/CRITICAL vulnerabilities while preserving runtime behavior and image size. The examples assume Debian/Ubuntu apt-get; adapt only the package-manager command for non-apt images.

Workflow

1. Identify the input:
   • Dockerfile: build a local source image first, for example docker build -t app:scan-source -f Dockerfile ..
   • Existing image: pull or inspect it directly, for example docker pull python:3.12.
2. Ensure Trivy is installed: macOS brew install trivy; Linux use the official Trivy package instructions; Windows winget install aquasecurity.trivy or choco install trivy.
3. Capture baseline image size: docker image inspect IMAGE --format '{{.Size}}'.
4. Scan only actionable severities: trivy image IMAGE --severity HIGH,CRITICAL.
5. Record each vulnerable package with a fixed version. Separate findings without fixes.
6. Patch only the specific packages that have fixes. Add a late Dockerfile layer, or create a temporary patch Dockerfile for image-only input: