not to be pedantic but why should containers be patched for security issues?

the entire point of containers (and orchestration systems) is the ability to push updates without downtime.

Just update with a newer container....am I missing something?

Also about container security - a strict process internally can easily help counter that (I believe Shopify had a nice talk about it at the Google Cloud Platform event in Toronto - everything from using trusted images, running only signed images and going through a security check for each layer).

EDIT: To add to it, please don't patch containers - the entire point of an "image" is that if I run it locally and on my datacenter - it should behave the same - live patching them just voids this concept.