docker Distroless Base Image Findings: 8 Published, 0 Findings
Eight published images fanned out from a single registry. The published set reports zero findings at every severity: 8 images scanned, 0 findings, 14 application-layer fixes applied.
#container-security
8 posts
docker 
docker 69 to 67: The Honest Result of Remediating Distroless
Google Distroless has no shell, no apt and no dpkg. A full Debian 13 upgrade changes nothing and exactly one of its 64 OS findings has a fix published anywhere. This is the write-up of a remediation that cleared two findings for 0.1 MB, and of why that is the correct answer rather than a disappointi
docker Zero: The Image That Was Already Clean
Chainguard Hummingbird scans at zero findings in both layers. It was asked to be fixed anyway, so it was re-verified from its digest instead: 0 OS, 0 app, still booting in 8s, still non-root. The interesting part is why rebuilding a clean image would have been the wrong move.
java 1 Finding to Zero: The One-Line Dockerfile Fix for CVE-2026-46675
A published Java 21 Alpine base image looked permanently stuck at one UNKNOWN CVE. It was not unfixable — it was a stale package snapshot. One RUN apk upgrade cleared it for 3.1 MB.
java Java 21 Base Image Remediation Programme
Created: 2026-10-03 · Owner: hellodk · Status: image 1 of 3 complete
rhel 115 to 56: Remediating an Image That Cannot Patch Itself
UBI Micro scored 115 findings, 3 CRITICAL in Tomcat, and ships no rpm, dnf or microdnf — nothing inside it can upgrade anything. Building the fix outside and copying it in cleared 59 and introduced none, for +4.8% size. Three build bugs along the way, the last silently duplicating a 62 MB JAR.
rhel 895 to 575: Remediating Red Hat UBI 9 Full
The only image in the comparison with a package manager was also the worst offender at 895 findings. Its security channel turned out to be completely empty. A full dnf upgrade cleared 320 of them — and quietly introduced 20 new ones.
java 7 Java 21 Base Images Compared: 3 Are Genuinely Clean, the Smallest Cannot Be Fixed
One Spring Boot application built once and shipped across 7 Java 21 base images. Layer-split Trivy scans, boot-tested, digest-verified. 2 candidates return zero findings at every severity, and the smallest image in the set carries 8 HIGH findings with no published fix.