From scan to patch: handling container CVEs in a home lab
Patching the host doesn’t patch your containers. Each image ships its own copies of libraries, and they stay at whatever version was built in until the image is updated. This is how I find those libraries in my home lab and fix them without breaking the services that use them.
1. Scan the images, not just the host
Every week, Trivy, a free open-source scanner, checks the container images my lab services run on. It reads the operating-system packages and language libraries inside each image, matches them against known CVEs, and reports the version that fixes each one.
2. Make critical findings come to you
A scan report nobody reads protects nothing. My results land on a card in my lab dashboard, and anything rated critical also raises an alert in my Wazuh SIEM. A new critical finding reaches me the same way a suspicious sign-in would.
3. Triage before you touch anything
Not every finding is urgent. The signals from CVSS, EPSS and CISA KEV still apply: is it known to be exploited, how likely is exploitation, how bad would it be, and can an attacker actually reach the vulnerable code? Then check whether a fixed version exists. Often the cleanest fix is moving to a newer release of the image rather than swapping one library by hand.
4. Change it like production
When a CVE turned up in the Brotli compression library inside containers that were already running, I treated the fix like a production change, even at home. The change script works in phases:
- Back up first, so there’s something to go back to.
- Apply the change in stages, not all at once.
- Verify afterward that the services still work and the fix took.
- Roll back automatically if a check fails.
5. Write it down
My changes go out through hash-verified scripts and get recorded in a release log. If something breaks a week later, I can see what changed and when, and confirm the script that ran is the one I reviewed.
6. Let the next scan have the last word
A fix isn’t done until the next scan agrees. If the finding is gone, it worked. If it’s still there, the image I changed probably isn’t the one actually running.
Takeaway: scan images every week, send critical findings to the SIEM, triage with KEV and EPSS, and patch with a backup, verification checks and an automatic rollback.