An on-call engineer patches a CVE inside a long-lived utilities-billing container with docker exec and apt-get. What is the Docker-native fix so the running instance matches what is in the registry?
Select an answer to reveal the explanation.
Short Explanation
Patching a live container with docker exec makes a snowflake that no longer matches the registry. Rebuild the image and replace the container—immutability at the container layer.
Full Explanation
In-place package changes via docker exec produce a container that diverges from the image stored in the registry. The Docker-native pattern is to bake the fix into a new image and replace the container. That is immutability at the container layer, not Resource Manager/Terraform mutation of a live filesystem and not exporting the writable layer as durable architecture.