# project-copacetic/copacetic

🧵 CLI tool for directly patching container images!

Repository: https://github.com/project-copacetic/copacetic
Canonical: https://ross.abutalabs.com/products/copacetic
Homepage: https://project-copacetic.github.io/copacetic/
Language: Go
License: Apache-2.0
License Family: permissive
Topics: compliance, devsecops, docker, security, trivy, vulnerability, containers, container-image, container-security, patching, cncf, hacktoberfest, vulnerabilities, vulnerability-management, security-tools
Last push: 2026-08-26T12:18:09+00:00

## Health v2 (maintenance only)
Score: 91/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 79, longevity 95
- inputs: {"age_days": 1330, "days_push": 7, "days_rel": 62, "gap_med": 67, "n_releases_24m": 10}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1700, forks 123 (observed 2026-08-28T04:05:24.210158+00:00)

## What it is
Copa (Project Copacetic) is a Go CLI tool built on BuildKit that directly patches OS package vulnerabilities in container images without requiring full rebuilds. It can consume vulnerability scan reports from tools like Trivy to patch images quickly so they can be redeployed into production.

## Use cases
- patch container image vulnerabilities without a full rebuild
- fix CVEs in third-party images I don't maintain
- patch base image vulnerabilities inherited several layers deep
- apply Trivy scan results to patch a container image
- quickly remediate critical vulnerabilities and redeploy images to production
- patch Ubuntu chiseled and apt-less container images

## When to choose
- you need to patch OS package vulnerabilities in images faster than upstream rebuilds allow
- your security SLAs are shorter than third-party image maintainers' update cadences
- you already use Trivy or similar scanners and want report-driven patching

## When to avoid
- you need to patch application-level dependencies (e.g., npm, pip packages) rather than OS packages
- you prefer rebuilding images from updated Dockerfiles as part of your CI pipeline
- you need to patch non-Debian/Ubuntu-based images without supported package managers

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, container-runtime, cli, vulnerability-scanning, deployment
- domain: security, developer-tools
- platform: windows, cli
- tags: container-image-patching, vulnerability-management, buildkit, trivy, devsecops, cncf, containers, devops, linux, macos, docker

## Member repositories
- project-copacetic/copacetic (main) score 91

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:24.210158+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:37:46.490687+00:00, confidence not recorded.
  - readme: https://github.com/project-copacetic/copacetic (fetched 2026-08-28T04:05:24.210158+00:00, sha 42edc27649fb)
  - homepage: https://project-copacetic.github.io/copacetic/ (fetched 2026-08-29T11:12:19.356649+00:00, sha 80243c8ef7a0)
- Data as of 2026-08-30T08:39:29.467469+00:00.