Docker images are built with binaries that have unpatched security bugs. They will continue to have them because the people building them do not care and do not understand how to actually build images.

If you build the images, and you either source binaries from a clean source or build them yourself, then your images might actually be sane. People and companies can automate this, and some do as part of their orchestration strategy.

Most people want the promise of Docker but don't want to have to actually learn how to orchestrate, and shoot themselves in the foot with images they got from some random dude on DockerHub, and no matter how much people try to educate them it just never sinks in.

Ok, but that seems different than:

> Every single package, every single dependency, that has an actively exploited security flaw is being exploited in the Docker images you're using

This says that every exploit in a docker image you use IS BEING exploited, not that it COULD BE exploited.

But you are aware that most orgs do scan images, right? It's like Docker 101.