> How do you recommend applying security updates to the image, short of running (for example) `apt-get dist-upgrade`? That's exactly how I recommend applying p

> How do you recommend applying security updates to the image, short of running (for example) `apt-get dist-upgrade`? That's exactly how I recommend applying patches. If it breaks things you can fix it. You don't do this on a live system: If you're smart and your live systems are ephemeral you can copy your image, get it working, verify it interactively, and once you have a working image, you spin up new instances using the new system, and start shutting down the old systems.