Containers are primarily created on the basis of ready-made images that are created by the user, but are also often obtained from the Internet. Furthermore, software is increasingly being delivered by manufacturers in the form of images. An IT department can also use these images to create their own images by adding, changing, or even removing software or configurations.

The software contained in the images could be vulnerable and the containers launched from the image could be vulnerable as a result. Such vulnerabilities may also often not be known to the IT department responsible, as the software contained in the images is often not recorded in their own software administration. As a rule, an IT department must rely on updates being made available through the image creation process. From the outside, it is often difficult to determine which software packages are contained in these images.

In addition, images may contain intentionally integrated malware, such as ransomware or crypto miners. Since a single image is often deployed in a large number of containers, the resulting damage can be immense.