The kernel CNA now assigns CVEs to almost every bug fix but refuses to score them. Manual triage can't scale; blind patching causes update fatigue. bootc (bootable containers) reconciles both: atomic updates, environmental triage by design, and patch-as-policy.