containers Patching Without a List: A Nightly Pipeline That Finds Its Own Targets Every image list you maintain by hand is stale the day after you write it. Our Copacetic pipeline discovers candidates from Harbor's own scan results instead.
containers Your Most Secure Images Are the Ones Copacetic Can Never Patch Hardened and distroless bases strip the package manager, which means Copacetic has nothing to run. 96 fixable CVEs, no apk, and the right response is a base bump, not a Copacetic bug report.
containers 105 CVEs to Zero in 40 Seconds: What Copacetic Actually Does to an Image Copacetic patched every fixable OS CVE on our fixtures without a rebuild — and left every application dependency untouched. Both halves of that sentence matter.
