docker Distroless Base Image Findings: 8 Published, 0 Findings
Eight published images fanned out from a single registry. The published set reports zero findings at every severity: 8 images scanned, 0 findings, 14 application-layer fixes applied.
#distroless
4 posts
docker 
docker 69 to 67: The Honest Result of Remediating Distroless
Google Distroless has no shell, no apt and no dpkg. A full Debian 13 upgrade changes nothing and exactly one of its 64 OS findings has a fix published anywhere. This is the write-up of a remediation that cleared two findings for 0.1 MB, and of why that is the correct answer rather than a disappointi
java 1 Finding to Zero: The One-Line Dockerfile Fix for CVE-2026-46675
A published Java 21 Alpine base image looked permanently stuck at one UNKNOWN CVE. It was not unfixable — it was a stale package snapshot. One RUN apk upgrade cleared it for 3.1 MB.
java 7 Java 21 Base Images Compared: 3 Are Genuinely Clean, the Smallest Cannot Be Fixed
One Spring Boot application built once and shipped across 7 Java 21 base images. Layer-split Trivy scans, boot-tested, digest-verified. 2 candidates return zero findings at every severity, and the smallest image in the set carries 8 HIGH findings with no published fix.