~/talk

Your Python container is 90% stuff you didn't ask for

on YouTube 30m
Talkat PyCon AU 2026 · 2026-08-26..08-30· [security]

speaker

name:Scott Norris
links:none on file

resources

video:https://youtu.be/DLg5v2yIX4k
slides:none on file

summary

Docker pull python:3.x promises Python and instead delivers ~430 packages — a shell, package managers, compilers and hundreds of known CVEs — so the real question is how many vulnerabilities and how much paperwork. The demonstration uses sift, gripe, Trivy to generate SBOMs and scans, showing images with 1,951 vulnerabilities vs slim or distroless variants with only a few dozen and nonroot, no-shell, no-compiler builds that materially reduce attack surface and operational effort.

AI-written summary · about

chapters (10)

  1. 0:00Welcome
  2. 1:07What's in containers
  3. 5:01Container inspection tools
  4. 7:48Image sizes and vulnerabilities
  5. 13:54Every binary is risky
  6. 17:37CVE growth in open source
  7. 21:34Minimal vs bloated demo
  8. 24:50Minimal container benefits
  9. 27:38Impact of container choices
  10. 29:25Key takeaways

related talks

~/search
type to search 6,249 conferences, 138,987 speakers and 185,172 talks
~/help
cmdctrl k
search every conference, speaker and series
/
focus the filter search
h
home
c
conferences
s
speakers
e
series
t
light / dark — the status bar button does the same
?
this help
esc
close this, then clear every filter — or just the search, while you are typing in it

Ignored while you are typing. Pages without a filter rail have no search to focus.