After building an updated image, the deployment system must start containers from it. This may involve replacing a single Docker container, updating a Compose service or rolling a new deployment through a container orchestrator.
Redeployment activates the new image; rebuilding only prepares it. If the deployment still points to the old image digest, a restart may simply launch the same vulnerable software again. A mutable tag can also make it difficult to know which image version is running.
Rolling updates can keep a service available while old and new instances overlap. During that period, some requests may still reach old containers until the rollout completes. A failed rollout can leave a mixed deployment or trigger a rollback.
Verify the intended image digest, inspect rollout status and health checks, then confirm that every running replica uses the patched image and that old containers have stopped.