Immutable and certified containers
Immutable containers are containers that will never be changed while running. You do not step into the running immutable container to replace one or more binaries. From an operational standpoint, you rebuild and redeploy an updated container image to replace a container instead of changing it.
Consuming security updates is particularly important when managing immutable containers.
Red Hat certified images are:
-
Free of known vulnerabilities in the platform components or layers
-
Compatible across the RHEL platforms, from bare metal to cloud
-
Supported by Red Hat
The list of known vulnerabilities is constantly evolving, so you must track the contents of your deployed container images, and newly downloaded images, over time. You can use Red Hat Security Advisories (RHSAs) to alert you to any newly discovered issues in Red Hat certified container images, and direct you to the updated image. Alternatively, you can go to the Red Hat Ecosystem Catalog to look up that and other security-related issues for each Red Hat image.