To fix a zero-day in a container image, list the images running now, scan their layers for the affected package, update the package or base image, rebuild, redeploy, and remove old tags from registries. Fixing the source repository is not enough, because deployed images keep the old library until they are replaced.
Why images need their own check
An image bundles operating system packages and application libraries at build time. A repository scan reads source files. The image can hold packages that are not in source, and it can be months older than the current code.
Step by step
- List what is running. Query the cluster or host for image names and digests, not just tags. Tags can move.
- Scan the images. Search each layer for the affected package and version range.
- Find the origin. Is the package from the base image, an installed system package, or an application dependency? The fix location differs.
- Fix at the source. Update the base image tag, the package install line or the app dependency.
- Rebuild and test. Build a fresh image, run the test suite and the health checks.
- Redeploy. Roll out in rings. Confirm the running digest changed.
- Retire old images. Remove or quarantine vulnerable tags so no one deploys them by accident.
Where the fix goes
| Origin | Typical fix |
|---|---|
| Base image package | Move to a patched base image and rebuild every image that uses it |
| OS package installed in your Dockerfile | Update the install step, rebuild |
| Application library | Update the dependency, rebuild |
| No fix yet | Mitigate at the network or configuration level, rescan when the fix lands |
A single base image often feeds many services, so one base fix can mean many rebuilds. List them from your registry.
Catch the stragglers
Old images in stopped jobs, batch tasks and forgotten test environments often keep the flaw. Scan the registry as well as the cluster, and set a rule that images older than a chosen age are rebuilt.
Prevent a repeat
Rebuild images on a schedule, pin base images by digest, and keep a list of which services use which base. When a base image flaw lands, you can name the affected services in minutes instead of searching for them.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at which layer each finding comes from.
Where Safeguard fits
Safeguard scans container images and builds an SBOM from them, and policy gates can block deployment of images with a flagged package. Start with a free scan.
Quick check
If I patch the repository, are my containers safe?
No. Running containers keep their built contents until you rebuild and redeploy them.
Why track digests and not tags?
A tag can point to a different image over time. A digest identifies exactly what runs.
Last reviewed: 19 October 2026.
