It’s not that different from regular Linux distros. A container built from a distro base image (like Debian or alpine in the first part of this article) is just

It’s not that different from regular Linux distros. A container built from a distro base image (like Debian or alpine in the first part of this article) is just a packaged version of that distro + your app. Distro maintainers apply patches to software in their repositories and its your responsibility to update your system or image. What this article gets wrong is that it builds from a Debian base image without first performing apt-update && apt-upgrade. It’s similar to running a vulnerability scanner on a fresh install (with apply updates during install unchecked).