Rebuilt images drift less. A server patched in place accumulates changes over months, and each host ends up slightly different. An image is built once, tested, and replaced rather than modified, so every instance starts from the same content. Long-lived servers can work, but they need extra controls.
How in-place servers drift
Each patch run depends on what was installed, when the host was created, which repository state it saw, and whether the run succeeded. Two hosts created a year apart, patched on the same schedule, still differ. Manual troubleshooting adds more variation: a package installed to debug an issue, never removed.
Add in the packages that applications install themselves, and the true state of the fleet is hard to state.
How images change the picture
With images, change means building a new image, scanning it, and replacing instances. The unit of review is the image identifier. Kubernetes follows this model for workloads: the Deployment documentation describes a rolling update that creates a new ReplicaSet and scales it up while scaling the old one down, replacing pods at a controlled rate. Pods are replaced, not edited.
| Property | Patched in place | Rebuilt image |
|---|---|---|
| Unit of change | Individual host | Whole artifact |
| Record of state | Reconstructed | The image and its SBOM |
| Rollback | Undo changes by hand | Redeploy old artifact |
| Drift between hosts | Common | Rare, unless tags move |
| Effort to start | Low | Higher |
If you must keep long-lived servers
- Use configuration management to declare packages, and run it on a schedule.
- Export the installed package list from every host regularly and diff against the declared state.
- Block manual package installation on production hosts, or alert on it.
- Set a maximum host age, then rebuild from scratch when reached.
- Include these hosts in your advisory response, since they are the most likely to be missed.
Migrating step by step
- Pick one stateless service as the pilot.
- Containerize it with a pinned base image and a lockfile install.
- Run it alongside the existing hosts, and compare package lists.
- Shift traffic gradually, then retire the old hosts.
- Repeat with the next service, using the lessons from the pilot.
Stateful systems take more care. Move them last, and keep backups and restore tests in place.
A word on images
Images drift too if they are rebuilt from mutable tags or never refreshed. The advantage is that the drift is visible in one place. Pair rebuilt images with digest pinning and scheduled refreshes.
Try it yourself
Click through it at your own pace, or open it full screen.
Click through an image scan and note how every finding belongs to one image. That one to one mapping is the benefit of rebuilt artifacts.
What Safeguard does here
Safeguard scans container images and dependency files, monitors them over time, and supports asset discovery, which helps find hosts and workloads that fall outside your normal pipeline. Try the free scan at gold.safeguard.sh/scan.
Quick check
Do images remove the need to patch?
No. You patch by rebuilding. The process shifts from editing hosts to replacing them.
Is in-place patching wrong?
Not wrong, but it needs inventory and comparison so you know what each host runs.
Sources
Last reviewed: 19 October 2026.
