I first came across Project Copacetic (#Copa for short) in @markrussinovich keynotes about Azure where they use it to patch vulns in millions of container images a month, internally and for Azure users and I thought 'doesn't everyone with container images need to do this'?
Turns out, that's exactly what the Copa team (who also worked on tools like #Radius and #Dapr) thought, and when they open sourced it, other tools like Kubescape started to use it; Anubhav Gupta told me why it's so useful for platform teams. @descopeinc built a whole self-patching registry on top of it. Copa isn't perfect but Vadim Bauer told me it might be a useful plugin for updating images in Harbor the way Microsoft does in ACR with Copa and Dalec.
Microsoft still uses it at massive scale: "every build that goes through our engineering system for any team, runs through Copa,” @sozercan told me.
Copa doesn't create patches but as soon as there is a patch for an issue Trivy (or other scanners) find, it can apply it as a patch layer so you don't have to wait for an official image or even an image rebuild; you can use it with GitHub Actions and Dependabot; it does OS patches, distroless and now app runtime patches for Node.js, Python, .NET and soon Go patching too.
One of the frustrating things with open source is you don't always know who's using it: Bank of America and thousands of other companies are using Copa, almost everyone who's heard of it loves is but it still feels like a bit of a hidden secret in the #CNCF sandbox; maybe this will help!
Extra thanks to everyone who talked to me for this piece, since it was either in the run up to or actually at #Kubecon when everyone is extra busy! Also, hit me up if you're on Mastodon and I haven't tagged you here because @ mentions are being weird for me today...
https://www.thestack.technology/copacetic-copa-patch-containers-automatic-scale/
Habr
Johan Wassberg 
gary
Mary Branscombe
Matthew Slowe
devopstales
jobo
Chris Jakobsen
WDR (inoffiziell)
