Project Lightning Talk: Project Copacetic
Lightningat KubeCon + CloudNativeCon Europe 2025 · on Tuesday, 2025-04-01· at 13:47· Platinum Suite | Level 3·
summary
Project Copacetic claims it cuts image patch time from weeks to minutes by parsing scanner output and applying OS package updates as a new layer rather than rebuilding images. It uses Trivy and pluggable scanners like Gripe and Docker Scout, interprets RPM and DEB updates (now including Alma Linux), and can patch distroless images via external tooling. BuildKit builds a minimal patch layer and images are mirrored to GHCR to avoid Docker Hub limits. Multiarch and bulk patching are coming soon.
AI-written summary · about
related talks
20mProject Copacetic: Directly Patch Container Image Vulnerabilities
20mAutomated Vulnerability Patching with Copa
10mProject Zero Day: Building the Ultimate Container Defense System
42mContainer Patching: Making It Less Gross Than the Seattle Gum Wall
39mA Journey to Distroless
42mScan, Patch, VEX - Using Open Source Tools to Manage...
05mLightning Talk: Scaling Container Builds with Software Supply Chains
18mKernel Live Patching: Mitigating CVEs With Zero Downtime