Over 30% of Official Images in Docker Hub Contain Security Vulnerabilities
I have a few contentions with the study.<p>First, if you look at their own analysis the number drops from 30% to 23% when limited to only the latest tagged images in the official repository. I'd expect to see a higher rate of vulnerabilities in previous versions...that's why you rebuild. Find me a linux admin that would accept their OS is vulnerable if you're citing old, unpatched versions.<p>Second, they seem to virtually _all_ be package vulnerabilities. These would, ostensibly, reach parity with whatever the target distro is by simply updating packages on a rebuild.<p>Finally, I think one would be hard pressed to lay any vulnerabilities traced to updated, current packages at the feet of docker. That fault would seem to lie squarely with distro package maintainers.<p>So, two simple rules would seem to bring the security of container deployment in line with standard bare metal deployment (by the metrics applied in this research):<p>1. Don't use old shit<p>2. Rebuild your selected docker container to ensure packages are up to date. Why? See rule #1.