[feinte]

The problem lies in baking entire distribution into an image.

Using distroless images or "FROM scratch" with statically compiled app reduces the risks.

You still have to watch for your app dependencies updates but that's less work than for an entire distribution.

[mattgreenrocks]

Huh, I didn't know that was possible. So you could specify an app container that is then overlaid atop the OS container?

I suppose installing the dependencies ends up being easier if you know they'll end up in, e.g. a ubuntu 18.04 image, hence that's what people do.