Wait...
You mean to tell me I might not even be able to patch the vulnerabilities in a given docker container independent of being at the mercy of whoever created the image?
That's some bullshit. Please tell me I've got things not quite right.
I have an "updated" image that has a TON of vulnerabilities because chromium (I get the impression that it's just an electron app masquerading as a docker container), and that container is Debian 12.15 and I apt dist-upgraded it from the shell