Correct -- the base OS would auto-update, but with how it works today, you would still need to upgrade your own containers. I don't believe this problem of upd

Correct -- the base OS would auto-update, but with how it works today, you would still need to upgrade your own containers. I don't believe this problem of updating dependencies in containers will last forever -- its pretty reasonable that you could mark some dependency as "auto-updatable" in your own container -- then when there is an OpenSSL issue, the base container OS is upgraded, and your app restarted.