containers

A Docker image bundles application and “platform”, that’s correct. But usually the image is composed of a base image and the actual application. So the canonical way to handle security updates is to update the base image, then rebuild your application image.