Ideally your containers don't depend on bash, and instead are just running their app's process. So then any given scenario is generally only either upgrade bash

Ideally your containers don't depend on bash, and instead are just running their app's process. So then any given scenario is generally only either upgrade bash on every server (if the problem if lower in the stack than the container) or rebuild and redeploy every container (if the problem is in a library used at the app level).