Of course, but if you update your docker image, you're in the same boat. The solution shouldn't be don't install security updates. It should be having a workfl

Of course, but if you update your docker image, you're in the same boat. The solution shouldn't be don't install security updates. It should be having a workflow that tests and validates security updates before deploying them to production. And you should have this with or without docker.