A vulnerability is found in the base image used by 200 services generated from your service template. How do they all get fixed?

What the interviewer is testing

Whether you know that generated repositories are copies, and whether you have thought about fleet-wide change as a platform capability rather than an emergency.

Why the template does not help

A template generates and then has no further relationship with what it produced. Updating the template fixes service 201. The 200 already generated are unaffected.

This is the fundamental limitation of scaffolding, and it is discovered exactly at moments like this.

The two answers

Thin template, versioned dependencies. The shared substance lives in base images and libraries that the generated repository references by version. A base image fix then propagates through a version bump rather than through code changes — and the bump can be automated.

Automated fleet-wide change. Bots that clone every repository matching a criterion, apply a transformation, run the tests, and raise a pull request. This is the capability that makes a large estate maintainable, and mature platforms treat it as a first-class product feature rather than an incident tool.

Both are needed: versioning covers the majority, and fleet change covers what versioning cannot — code-level migrations, configuration changes, deprecation of an API.

The response now

Rebuild the base image with the fix and publish it. Trigger automated rebuilds of every downstream image, which requires knowing the dependency relationship — an image registry that records base image lineage, or an SBOM store keyed by digest.

Then measure currency: which running workloads are on the fixed base? The security question is about what is deployed, not what is in the registry, and that distinction is where remediation programmes stall.

What a strong answer adds

An admission policy that refuses images older than a defined age or built on a base marked deprecated. That converts patching from a request into a deadline with a mechanism behind it.

Common weak answers

Updating the template and notifying teams, which relies on 200 teams prioritising your emergency. Raising 200 tickets.