Project Copacetic: Directly Patch Container Image Vulnerabilities
summary
Project Copacetic (Copa) is a Go CLI that reads Trivy JSON output or scans an image itself then applies OS package upgrades as a single new Buildkit patch layer onto the original image so rebuilds are unnecessary. Demos show patched images rescanned to zero vulnerabilities, and Copa can patch distroless images. Integrations include a Docker Desktop extension and a GitHub Action. Limitations: OS‑level only, no Windows support, multi‑arch and bulk patching are planned but not yet available.
AI-written summary · about
chapters (14)
- 0:00Introduction to Project Copacetic
- 1:23Current solutions for patching images
- 3:32What is Project Copacetic
- 5:15How Copa works under the hood
- 6:19Benefits of using Copa
- 8:08Limitations of Copa
- 8:52Demo: Patching with vulnerability report
- 10:43Demo: Patching all outdated packages
- 12:31Optimizing patch layers
- 13:14Docker Desktop integration
- 14:43GitHub Actions integration
- 16:07Future plans for Copa
- 16:50How to get involved
- 17:57Q&A session
related talks
20mAutomated Vulnerability Patching with Copa
05mProject Lightning Talk: Project Copacetic
10mAutomatically Patching Container Image Vulnerabilities with Kubescape & Copa
27mHot Fix: Securing the Vulnerable Images with Copa
42mScan, Patch, VEX - Using Open Source Tools to Manage...
10mProject Zero Day: Building the Ultimate Container Defense System
39mA Journey to Distroless
39mFrom Discovery to Fix: What 10,000 Open Source Projects Reveal About CVE Remediation