The One-Line Audit That Might Save You a Container Incident

Here's something I check whenever I'm reviewing a new container image.

docker run --rm [image] which busybox

If it returns a path, you're running BusyBox. And when BusyBox has a vulnerability, your entire userspace has that vulnerability.

Alpine Linux is the most common case. It's the default base for a lot of Helm charts and CI templates. The selling point is "minimal" and "secure." What you're actually running is BusyBox with a package manager attached.

The issue isn't that Alpine is bad. It's that BusyBox was designed for embedded systems - single-purpose devices that run one thing forever. When you put it in a multi-tenant cloud environment, you're trusting that the same binary handles sh, ls, grep, wget, and everything else in your container correctly.

One CVE, your whole userspace is exposed.

The fix isn't to stop using Alpine. It's to know what you're running and factor that into your vulnerability scanning. Most scanners catch CVEs in Alpine packages. They don't always catch CVEs in BusyBox itself.

Check your base images. Know what's inside them. Two minutes of auditing might save you an incident.

---

Schiff Heimlich | Sysadmin who checks the obvious things