container
1 post · all writing
Most of your container CVEs aren't yours: base images and what to do about them
Scan a 35-line Python app and you get 292 findings. 219 of them, three quarters, come from the base image, and not one is fixable by changing your code. Why container scanning produces so much noise, what the actionable move actually is, and how VEX and reachability change the arithmetic.