> ## Content Index > Fetch the complete content index at: https://www.ostering.com/llms.txt > Use this file to discover other available public pages before exploring further. # Container Images (IM) - URL: /taxonomies/software-factory/container-images/ - Published: 2026-10-31T13:00:00.000Z - Updated: 2026-10-29T12:57:47.974Z - Description: Container Images (IM): 13 threats in the software factory threat taxonomy, with mitigations. Base images, Dockerfiles, layers, image builds, tags and digests. - Author: Brett Crawley [Taxonomies](/taxonomies/) › [Software factory](/taxonomies/software-factory/) › Container Images **Station 14 of 17 · Line 2, Artifact to Runtime · 13 threats · prefix IM** An image freezes a whole operating system and its contents into one artifact, including whatever the build let in. These cards cover base images, Dockerfiles, layers, image builders, tags and digests. **Scope:** Base images, Dockerfiles, layers, image builds, tags and digests. ![Table: Container Images (IM), 13 threats with their mitigation principles and design measures. The full text is in the PDF and Excel downloads on the software factory taxonomy overview page.](https://www.ostering.com/media/posts/117/taxonomy-table-14-IM.png =1400x4648) *Text version: every entry on this page is in the [PDF and Excel downloads](/taxonomies/software-factory/) on the overview page, where it can be searched and copied.* ## The threats - **IM·A** Untrusted Base Image - **IM·K** Tag Instead of Digest - **IM·Q** Secrets in Layers - **IM·J** Fetch During Image Build - **IM·10** Builder Escape - **IM·9** Fetch on Start - **IM·8** Malicious Public Image - **IM·7** Root and Tools by Default - **IM·6** Stale Image - **IM·5** Build Context Leakage - **IM·4** Invisible Layer Contents - **IM·3** Multi-Architecture Inconsistency - **IM·2** Self-Declared Metadata ## Where this station touches others - **Container Images and Container Runtime:** the image is what is packaged; the runtime is how it is contained. ## Seen in the wild - **IM·Q Secrets in Layers:** Codecov Docker image credential (2021). - **IM·10 Builder Escape:** Leaky Vessels BuildKit flaws (2024). - **IM·8 Malicious Public Image:** docker123321 images on Docker Hub (2018). Sources for each case are listed on the [overview page](/taxonomies/software-factory/). ## STRIDE, CAPEC and CWE Of the 13 entries here, STRIDE fits 10 cleanly and 3 only loosely. CAPEC 3.9 has a pattern that describes 7 of them directly, only a generic parent pattern for 5, and nothing for 1. CWE 4.20 names the weakness directly for 12, has only a broader weakness for 1,. The table below gives the mapping entry by entry, with the names of the CAPEC patterns and CWE weaknesses; what the mapping shows across the whole taxonomy is in [Mapping the Software Factory Threat Taxonomy to STRIDE, CAPEC and CWE](/mapping-the-software-factory-threat-taxonomy/). The Excel, SKOS and STIX downloads carry the same mapping as text. ![Table: STRIDE, CAPEC and CWE mapping for Container Images (IM), 13 threats, with each entry's STRIDE categories and fit, CAPEC 3.9 patterns and CWE 4.20 weaknesses. The full mapping is in the Excel, SKOS and STIX downloads on the software factory taxonomy overview page.](https://www.ostering.com/media/posts/117/software-factory-mapping-table-14-IM.png =1400x2225) --- ← [Infrastructure as Code (IC)](/taxonomies/software-factory/infrastructure-as-code/) · [Software factory overview](/taxonomies/software-factory/) · [Container Runtime (RT)](/taxonomies/software-factory/container-runtime/) → *© 2026 Jonathan Brett Crawley. Licensed under [CC BY-NC-ND 4.0](https://creativecommons.org/licenses/by-nc-nd/4.0/) with additional permissions: see the licence on the [software factory overview](/taxonomies/software-factory/).*