It also is desirable that you can programmatically process configuration files (example: go through all your docker files to determine which ones use vulnerable

It also is desirable that you can programmatically process configuration files (example: go through all your docker files to determine which ones use vulnerable images) That is at odds with using a generic Turing complete language, as figuring out what the configuration is requires running code that may do all kinds of weird things (download data, delete files, etc) (that is similar to the postscript/PDF case. To figure out how many pages a postscript file has, you have to run code) Now, some will say they trust those writing config files to not do stupid things and only use that power when it is absolutely required, but that’s not an opinion shared by all.