containers Your Most Secure Images Are the Ones Copacetic Can Never Patch Hardened and distroless bases strip the package manager, which means Copacetic has nothing to run. 96 fixable CVEs, no apk, and the right response is a base bump, not a Copacetic bug report.
containers 105 CVEs to Zero in 40 Seconds: What Copacetic Actually Does to an Image Copacetic patched every fixable OS CVE on our fixtures without a rebuild — and left every application dependency untouched. Both halves of that sentence matter.
containers Build the Fixtures Before the Tools: A Testing Methodology for Container Scanners A scanner comparison against whatever happens to be running is a number, not a comparison. Here is the fixture set — known-bad images pinned by digest — that makes tool claims testable.
containers Your 12,064 Findings Are Lying to You: Counting Images, Not Reports, with the Trivy Operator Trivy Operator emits one VulnerabilityReport per workload, not per image. Sum the reports and you double-count everything. Here is the jq that gets the real number.
