3 posts
java A published Java 21 Alpine base image looked permanently stuck at one UNKNOWN CVE. It was not unfixable — it was a stale package snapshot. One RUN apk upgrade cleared it for 3.1 MB.
java Created: 2026-10-03 · Owner: hellodk · Status: image 1 of 3 complete
java One Spring Boot application built once and shipped across 7 Java 21 base images. Layer-split Trivy scans, boot-tested, digest-verified. 2 candidates return zero findings at every severity, and the smallest image in the set carries 8 HIGH findings with no published fix.