Security Compliance in CI/CD

Container security's cheapest control is shipping less software, not scanning faster

Traefik Labs argues most CVEs in a container come from the OS packaging around the application, not the application. Its pitch is attack surface reduction rather than faster detection.