> There is even a govt project called Ironbank to offer something like this to the DoD.

Note that you don't have to be DoD to use Iron Bank images. They are available to other organizations too, though you do have to sign up for an account.

Many IronBank images have CVEs because many are based on ubi8/9 and while some have ubi8/9-micro bases, there are still CVEs. IronBank will disposition the critical and highs. You can access their Vulnerability Tracking Tool and get a free report.

Some images like Vault are pretty bare (eg no shell).