Automatically Patching Container Image Vulnerabilities with Kubescape & Copa
summary
Adds a new kubescape patch CLI that scans an image with Kubescape (Grype engine), generates an image vulnerability report, calls Copa to apply upgrades as a single patch layer, and rescans the patched image. A modular Copa plugin system is added so Copa can accept reports from any scanner, not just Trivy. Example: nginx:1.23 goes from 265 → 198 reported vulnerabilities because remaining issues lack fixes upstream.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:06LFX mentorship goals
- 1:48Kubescape and Copa tools
- 2:10Adding scanner support
- 3:55Integrating workflows
- 4:58Live vulnerability patching demo
- 6:25Key takeaways
- 7:50Industry collaboration
- 8:32Future aspirations
- 9:15Q&A
related talks
20mAutomated Vulnerability Patching with Copa
27mHot Fix: Securing the Vulnerable Images with Copa
20mProject Copacetic: Directly Patch Container Image Vulnerabilities
10mProject Zero Day: Building the Ultimate Container Defense System
42mScan, Patch, VEX - Using Open Source Tools to Manage...
34mContainer Vulnerability Management in Kubernetes
25mMy Container Image has 500 Vulnerabilities, Now What?
32mA Security State Of Mind: Compliance and ...