For most SRE teams, CVE remediation has become a never-ending source of toil—rebuilds, backports, emergency releases, and late-night firefighting. This talk explores how Chainguard flips that model by removing vulnerability remediation from the SRE workload entirely. We’ll look at how secure-by-default images, continuous rebuilds, and automated patch pipelines eliminate the need for teams to chase CVEs in production. Instead of reacting to vulnerabilities, SREs inherit artifacts that are already patched, minimal, and ready to run—freeing them to focus on reliability, performance, and scale. This session is about shifting CVE response left, shrinking the attack surface, and giving SRE teams their time back—because patching shouldn’t be an on-call responsibility.
AJ Mejorado is a Solutions Engineer at Chainguard with a background in DevOps and CI/CD. He focuses on helping teams improve software delivery practices, scale pipelines safely, and reduce risk across the development lifecycle. AJ has held engineering, sales engineering, and product education roles, including helping build certification programs and developer enablement initiatives.
