Ask HN: How to handle security updates for Docker images?

When you deploy an app as a Docker container, the image is built at deploy time, meaning the libraries only have a chance of being updated the next time you deploy/rebuild your image. Is there any recommended workflow/tools to handle rebuilding your image as soon as a dependency gets a (security) update?