Hot Fix: Securing the Vulnerable Images with Copa
summary
Vulnerability census claims 2023 Sysdig finds 87% of container images with critical/high issues; Copa (Copa setic) is a CNCF Sandbox CLI that reads scanner JSON from Trivy, generates an LLB patch via buildkit/LLB, and adds a patch layer instead of rebasing to avoid cache eviction. Demo uses redis:7.0.4, finds one critical CVE, applies a hot-fix layer and rescans to show zero criticals. Tool only addresses OS-level CVEs, not application dependencies, and supports Rego filters and a GitHub Action for CI integration.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 2:55Patching in SDLC
- 6:56Rebasing vs patching
- 10:50Introducing Copa
- 13:33Copa architecture
- 14:35BuildKit and LLB
- 17:01Demo setup
- 18:29Scanning Redis with Trivy
- 21:02Vulnerability report
- 22:05Applying patch with Copa
- 23:15Verifying patched image
- 24:40Debugging and OpenVEX
- 26:35Q&A
related talks
20mAutomated Vulnerability Patching with Copa
10mAutomatically Patching Container Image Vulnerabilities with Kubescape & Copa
20mProject Copacetic: Directly Patch Container Image Vulnerabilities
10mProject Zero Day: Building the Ultimate Container Defense System
42mScan, Patch, VEX - Using Open Source Tools to Manage...
32mA Security State Of Mind: Compliance and ...
47mSecuring Containers By Breaking In
39mFrom Discovery to Fix: What 10,000 Open Source Projects Reveal About CVE Remediation