I update my docker containers regularly but doing it in a reproducible, auditable, predictable way
Could you explain how you achieve this?
Chainguard, Docker Inc’s DHI etc. There’s a whole industry for this.