A recent survey by BellSoft highlights the ongoing challenges faced by developers when it comes to container security. Among the 427 developers surveyed, nearly a quarter (23%) reported experiencing container security incidents in the past year. Human error is cited as a major cause, accounting for 62% of these incidents. Despite security being a top priority for 29% of respondents, many developers continue to rely on general-purpose Linux distributions and JDKs, which necessitate additional security work.
Pre-hardened container images are preferred by 48% of developers for mitigating security vulnerabilities, as they offer a more streamlined approach compared to managing security independently. However, 69% still employ general-purpose JDKs, and 55% use general-purpose Linux distributions, introducing further security complexities. A significant obstacle emerges from bloated base images, with unnecessary tools (such as shells at 54% and package managers at 39%) contributing to potential security gaps.
Time constraints and organizational prioritization—or lack thereof—further exacerbate security challenges. About 49% highlight time limitations, while 36% point to insufficient prioritization within their organizations. Despite these hurdles, only 43% utilize vulnerability scanning tools and just 36% maintain regular patching schedules, suggesting a need for more proactive security practices.
A separate report by Chainguard underscores that the bulk of container vulnerabilities are found outside the top 20 most popular base images, with 98% of CVEs residing in less-common images. This finding indicates that overlooked dependencies present heightened security risks, contrary to the common focus on widely-used images.
Ultimately, security-focused base images are proposed as a solution to reduce vulnerabilities and alleviate the security management burden on developers. The emphasis must be on proactive measures, including frequent updates, the use of SBOM tools, and image signing, to effectively secure containerized applications.

Collections

A BellSoft survey of 427 developers reveals that 23% experienced container security incidents in the past year, with human error causing 62% of cases. Despite security being a priority, 69% use general-purpose JDKs and 55% use general-purpose Linux distributions, creating security complexities. Bloated base images with unnecessary tools (shells at 54%, package managers at 39%) contribute to vulnerabilities. Time constraints (49%) and organizational deprioritization (36%) hinder security efforts, while only 43% use vulnerability scanning and 36% maintain regular patching. A Chainguard report shows 98% of CVEs exist in less-common base images outside the top 20. Pre-hardened container images, frequent updates, SBOM tools, and image signing are recommended as proactive security measures.

Container Security Challenges Highlighted by Developer Survey