Automatic application of software patches to software associated with container images based upon image relationships in a dependency tree. The computing device determines whether software associated with a base container image requires software patches. The computing device accesses dependency trees maintaining image relationships between the base container image and dependent container images. The computing device determines based upon the accessed one or more dependency trees whether the base container image has dependent container images derived from the base container image. The computing device applies software patches to the software associated with the base container image. The computing device rebuilds the base container image with the applied software patches. The computing device then rebuilds the dependent container images dependent upon the rebuilt base container image.