As the Container Image Controller knows the dependencies each image is made of, it can pro-actively check for CVEs and re-build the affected images