Security & supply chainZero CVEs by default is a floor, not a moat
Docker is pitching its Hardened Images catalog as a way to make zero-CVE base images the default across your pipeline. That is a defensible floor. Treating a green scanner and a signed SBOM as the finish line is exactly how the last year of supply-chain incidents happened.