> Luckily most of those vulnerabilities will be dormant, impossible to reach and exploit. Hopefully. Our people who use docker for some of our infrastructure h

> Luckily most of those vulnerabilities will be dormant, impossible to reach and exploit. Hopefully. Our people who use docker for some of our infrastructure have taken to using locally rolled images (from scratch or by updating official ones) for this reason. I don't think any of the issues found when we scanned were actually exploitable in our config, but we need to be a bit more careful than just hoping (due diligence & security-in-depth and all that - an unknown flaw elsewhere could expose one of the issues and that in turn allow some form of DoS, data exfiltration, or arbitrary code execution). We were surprised how much excess stuff, much of it out of date, is in some official images. Sometimes even the required dependencies seemed slower to be updated than we would prefer.