When Trivy reports vulnerabilities in a Docker image, the most effective fix is usually to update the image tag to the latest stable version. Newer tags bundle updated base OS packages with security fixes baked in.
docker pull nginx:stable
Pin to a specific digest for reproducibility (check what nginx:stable currently resolves to):
docker inspect nginx:stable --format '{{.RepoDigests}}'
Rename the old container rather than deleting it, in case you need to revert:
docker stop gp_booking_nginx
docker rename gp_booking_nginx gp_booking_nginx_old
Use the same network, mount points, and restart policy as the original:
docker run -d \
--name gp_booking_nginx \
--network gp_booking_app_gp_booking_network \
--restart unless-stopped \
-p 80:80 \
-p 443:443 \
-v /var/www/html/gp_booking_app/nginx/nginx.conf:/etc/nginx/nginx.conf:ro \
-v /var/www/html/gp_booking_app/nginx/conf.d:/etc/nginx/conf.d:ro \
-v /var/www/html/gp_booking_app/ssl:/etc/nginx/ssl:ro \
-v /etc/letsencrypt:/etc/letsencrypt:ro \
-v /var/log/nginx:/var/log/nginx \
nginx:stable
# Config syntax
docker exec gp_booking_nginx nginx -t
# All domains respond
curl -sI https://gp.veripath.co.uk/
curl -sI https://security.veripath.co.uk/dashboard/
trivy image nginx:stable --severity CRITICAL,HIGH --no-progress
docker stop gp_booking_nginx
docker rename gp_booking_nginx gp_booking_nginx_new
docker rename gp_booking_nginx_old gp_booking_nginx
docker start gp_booking_nginx
Keep the old container stopped for 48 hours, then remove it:
docker rm gp_booking_nginx_old
| Metric | nginx:1.25 (old) | nginx:stable (new) | Change |
|---|---|---|---|
| Total vulnerabilities | 465 | 29 | -94% |
| Critical | 16 | 0 | -100% |
| High | 87 | 29 | -67% |
:latest (which is the mainline/bleeding-edge branch in nginx's version scheme).nginx:1.30.2) once you've tested, so future updates are deliberate.