> For the complete documentation index, see [llms.txt](https://docs.snyk.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.snyk.io/scan-fix-and-prevent/scan-with-snyk/snyk-container/scan-your-dockerfile/fix-vulnerable-base-images-in-your-dockerfile.md).

# Fix vulnerable base images in your Dockerfile

How to fix vulnerable base images in your Dockerfile

## Automatic Pull Requests (PRs)

Snyk detects vulnerable base images by scanning your Dockerfile when importing a Git repository and helps you fix them using automatic pull requests. This allows you to examine security issues before you build the image and fix them before they land in your registry or in production.

Supported Git-based repository managers for Dockerfile fix PRs include:

* GitHub
* GitLab
* Bitbucket Server
* Bitbucket Cloud
* GitHub Enterprise
* GitHub Cloud App
* GitHub Server
* Azure Repos

For any Dockerfile Project created in Snyk, if the base image is a [Docker Official image](https://docs.docker.com/docker-hub/official_images/), the results include a list of suitable base images that can be used instead of the existing, more vulnerable one. For more information, see [Analyze and fix container images](/scan-fix-and-prevent/scan-with-snyk/snyk-container/use-snyk-container/analyze-and-fix-container-images.md).

Snyk then automatically issues a fix pull request against your Dockerfile to upgrade to the latest minor version available.

{% hint style="info" %}
In a multi-stage build, Snyk analyzes only the final stage.
{% endhint %}

Snyk opens an automatic fix PR when there is a change in the Dockerfile or when it identifies a better base image after the initial scan.

### Enable automatic update of Dockerfile base images

The feature is available for all Snyk users. It is on by default for all users with free accounts and off by default for existing integrations of Snyk customers.

To enable automatic update PRs, navigate to **Settings** > **Integrations** and select your connected source code manager. On the settings configuration page, under **Dockerfiles**, toggle **Enable automatic update PRs**.

<div align="left"><figure><img src="https://2730497224-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBJO0IZx7zB6bOkotxQP2%2Fuploads%2Fgit-blob-2f4caba9a5588499b06467209dae36bf01f796bc%2Fenable_automatic_PRs.png?alt=media" alt="Enable auto-update PRs for base images"><figcaption><p>Enable automatic update PRs</p></figcaption></figure></div>

## Open a fix PR manually

Alternatively, you can open a fix PR manually from the Project page by clicking **Open a Fix PR** for the base image version you wish to upgrade to.

<figure><img src="https://2730497224-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBJO0IZx7zB6bOkotxQP2%2Fuploads%2Fgit-blob-b72a5127b6ababcab78d7f0ba5b7bc74f3931ab3%2Fopen_fix_PR.png?alt=media" alt="Open a fix PR to upgrade the base image"><figcaption><p>Open a fix PR</p></figcaption></figure>

After the fix PR is opened, you can view it in your Git repository and see what the change is and where it takes place. The `FROM` line in your Dockerfile is updated with the new and improved version.

{% hint style="info" %}
Ensure your application works properly before merging the change.
{% endhint %}

When the PR is opened and ready, you can safely merge it and instantly reduce the number of vulnerabilities in your container image.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.snyk.io/scan-fix-and-prevent/scan-with-snyk/snyk-container/scan-your-dockerfile/fix-vulnerable-base-images-in-your-dockerfile.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.