well containers, self contained tiny vms, etc. have one single downside. shared libraries do not work well with them, which means updating the host os does not

well containers, self contained tiny vms, etc. have one single downside. shared libraries do not work well with them, which means updating the host os does not fix anything inside the container. something that helps against that is actually running something like distroless, however that still won't make it, the best thing is probably update all the stuff every day automatically. (not a hard thing on something like k8s, etc..)