I doubt your “distroless” container is any safer for this vulnerability . Infecting sudo just makes for a quick demo. If your container has different process

I doubt your “distroless” container is any safer for this vulnerability . Infecting sudo just makes for a quick demo. If your container has different processes at different user ids, the exploit would still be effective. It would likely also be able to “modify” read only files mapped from the host.