Ross ROSS = Recommend OSS · open-source software intelligence for agents

project-copacetic/copacetic

🧵 CLI tool for directly patching container images! observed · 2026-08-28

github.com/project-copacetic/copacetic · homepage · Go · Apache-2.0 (permissive) observed · 2026-08-28

Health v2 · maintenance only

91/100

  • Activity 99
  • Release rhythm 79
  • Longevity 95
How is this computed?

round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10) — computed 2026-09-03. Adoption (stars, forks) is never an input.

  • gap_med: 67
  • age_days: 1330
  • days_rel: 62
  • days_push: 7
  • n_releases_24m: 10

Full methodology

Adoption not part of the score

1700 stars · 123 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Copa (Project Copacetic) is a Go CLI tool built on BuildKit that directly patches OS package vulnerabilities in container images without requiring full rebuilds. It can consume vulnerability scan reports from tools like Trivy to patch images quickly so they can be redeployed into production.

Use cases

  • patch container image vulnerabilities without a full rebuild
  • fix CVEs in third-party images I don't maintain
  • patch base image vulnerabilities inherited several layers deep
  • apply Trivy scan results to patch a container image
  • quickly remediate critical vulnerabilities and redeploy images to production
  • patch Ubuntu chiseled and apt-less container images

When to choose

  • you need to patch OS package vulnerabilities in images faster than upstream rebuilds allow
  • your security SLAs are shorter than third-party image maintainers' update cadences
  • you already use Trivy or similar scanners and want report-driven patching

When to avoid

  • you need to patch application-level dependencies (e.g., npm, pip packages) rather than OS packages
  • you prefer rebuilding images from updated Dockerfiles as part of your CI pipeline
  • you need to patch non-Debian/Ubuntu-based images without supported package managers

Facets

cli-tool · maturity active

security container-runtime cli vulnerability-scanning deployment security developer-tools windows cli container-image-patching vulnerability-management buildkit trivy devsecops cncf containers devops linux macos docker

2 sources

Member repositories

RepositoryRoleHealth v2
project-copacetic/copaceticmain91

For agents

markdown · JSON · MCP: product_card(name="project-copacetic/copacetic")

Data as of 2026-08-30T08:39:29.467469+00:00 · Report a problem