If you're using an upstream image from a distro, pull that down, update it, push it back to a registry, then use that as your base image. Do that every day in a CI/CD (or just cron) system, such that you've got logs, auditing and fires off alerts if something breaks.

Add update steps to the builds of your final image containers too at the start, to catch any delta that may have happened during last base image patch.

There are also container scanning tools but they can produce some false positives sometimes but useful nonetheless.

You still run tests as normal against the new images before promoting, just like normal.