Zero CVEs at delivery: Why container security belongs in the supply chain

What happened

It started as a Perl application, but these days it’s a single, static Go binary with all of its assets compiled right into the executable. But harmless code running on top of an unmaintained container image is an open door.

The moment you push an image to a registry and walk away, it silently collects known vulnerabilities as the world moves on. The volume of vulnerabilities published each year has outpaced what human triage can handle.

In the last 12 months, the National Vulnerability Database recorded 87,487 common vulnerabilities and exposures. That comes out to roughly 240 new CVEs every single day, an 82 percent surge over the prior year.

When you package a simple utility inside a standard Linux distribution image, you import hundreds of packages your code never touches. If any of those auxiliary packages develop a vulnerability, your application becomes a viable attack vector into your host infrastructure. If an image does not require a shell to run your code, it does not contain a shell.