Topic starter
21/08/2026 4:43 pm
TL;DR: Container base images now sit at the centre of software supply chain risk, with Rapidsort arguing that mature distributions, curated images, and scanner visibility matter more than cosmetic CVE counts. The practical issue is not eliminating every vulnerability, but reducing inherited exposure before workloads ever reach production.
Editorial analysis by NHI Mgmt Group, based on content published by Rapidsort: “Your Path to Near-Zero CVE Images”.
By the numbers:
- 85% of enterprise software is open source.
- 10 hrs from vulnerability disclosure to active exploit.
Key questions
Q: What fails when container images are small but not well governed?
A: Small images do not automatically mean lower risk if teams cannot prove what is inside them, who maintains them, and whether scanners can identify them correctly.
Q: Why do mature base images reduce software supply chain risk?
A: Mature base images reduce inherited risk because they arrive with broader community scrutiny, regular patch cycles, and clearer vulnerability reporting.
Q: How do teams know whether near-zero CVE claims are real?
A: Teams should verify that their scanners, SBOM processes, and vulnerability databases correctly recognise the exact image family and its components.
Practitioner guidance
- Validate distribution recognisability before adoption Confirm that your chosen base image family is detected and classified correctly by the scanners, SBOM tools, and vulnerability databases already in use.
- Govern base images as lifecycle assets Track who owns each image, when it was last patched, what changed in the dependency tree, and when the next rebuild is due.
- Prefer curated images for brownfield workloads Use maintained base images where legacy dependencies, missing package clarity, or fragile builds make scratch images too risky to sustain.
Bottom line: Near-zero CVE container images can lower inherited exposure, but only when the base distribution is mature, visible to scanners, and continuously maintained.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
21/08/2026 5:04 pm
Near-zero CVE is really a provenance problem: the decisive issue is whether teams can prove what is inside the image, where it came from, and how reliably it is scanned. A low vulnerability count is only meaningful when identification is accurate and the base image is governed as a lifecycle asset. For practitioners, that means treating image provenance and scanner visibility as first-class supply chain controls.
A few things that frame the scale:
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: When should organisations choose curated images over scratch images?
A: Curated images are usually the safer choice when workloads have legacy dependencies, unclear package requirements, or limited engineering capacity for continuous rebuilds. Scratch images can be effective, but only when the team can maintain the dependency graph and hardening effort over time.
👉 Read our full editorial: Near-zero CVE container images shift risk left in software supply chains