First, the author is being fooled by false positives due to bad scanner settings. Basically there are a huge number of CVEs that are meaningless, and closed by some distros but not others in the CVE databases. The result is a spew of "OMG LOOK AT THIS BADNESS" which security scanners vendors like because it makes them look useful, but is actually just noise.<p>Long version: <a href="https://pythonspeed.com/articles/docker-security-scanner/" rel="nofollow">https://pythonspeed.com/articles/docker-security-scanner/</a><p>Second, the author isn't installing security updates! You need to run `apt-get upgrade`, even for official images.<p>Long version: <a href="https://pythonspeed.com/articles/security-updates-in-docker/" rel="nofollow">https://pythonspeed.com/articles/security-updates-in-docker/</a><p>Third, Alpine has some issues in some cases, although for Go at least neither of these issues is usually relevant so Alpine is fine.<p>1. musl can be subtly incompatible with some applications, with annoying bugs. Personal experience: if you using minikube in a WeWork office, Alpine-based (or really, musl-based) containers would fail to resolve DNS inside Kubernetes due to a concatenation of circumstances that was mostly the fault of WeWork's ops team but which glibc handled better than musl. The problem has since been fixed by WeWork, AFAIK.<p>2. For Python specifically, binary precompiled packages (wheels) won't work on Alpine, which means you ahve to recompile the whole universe, which means container builds are slow. There's a PEP which might get this fixed, but for now, not worth it. <a href="https://pythonspeed.com/articles/alpine-docker-python/" rel="nofollow">https://pythonspeed.com/articles/alpine-docker-python/</a>