There are container management systems that can inform you of container images requiring patching. You can specify the policy for how to deal with these contain

There are container management systems that can inform you of container images requiring patching. You can specify the policy for how to deal with these container images: do you quarantine them, do you stop running that application, or whatever. TBH, you're presenting a happy path scenario that often fails to materialize. Sure, "apt-get upgrade openssl" and restart all affected daemons, keeping your fingers crossed everything will still work. It often doesn't, and now your system is borked. That's not a good way to run an operation.