There are container management systems that can inform you of container images requiring patching. You can specify the policy for how to deal with these container images: do you quarantine them, do you stop running that application, or whatever. TBH, you're presenting a happy path scenario that often fails to materialize. Sure, "apt-get upgrade openssl" and restart all affected daemons, keeping your fingers crossed everything will still work. It often doesn't, and now your system is borked. That's not a good way to run an operation.