A year-old image is not a vulnerability count

Lesson map

Lesson 14. Map, example, EX060.

flowchart TD
  Y["Developer: last rebuilt a year ago"] --> A["Monthly rebuild was agreed"]
  C["One-line confirmation"] --> E["Evidence that a message arrived"]
  Y --> Q{"Is the year a vulnerability count?"}
  C --> Q
  Q -->|No| K["No identifier was copied"]

Age is a sentence. A count would be a measurement.

Logical drawing

recorded:    older base, last rebuilt a year ago
agreement:   monthly rebuild, one-line confirmation
not recorded: digest, tag, registry, CVE, EPSS, image name

Learning outcomes

After this chapter, you should be able to:

1. Keep the image age as the developer's sentence.
2. Say what a one-line confirmation does not prove.
3. Refuse an imported vulnerability count.

14.1 No identifier enters the booking note.

The developer said the booking image was an older base last rebuilt a year ago. Fixes published for that base during the year did not arrive, even though the clinic had not changed the application's own code. The agreement that followed is a monthly rebuild from a maintained base, plus a one-line confirmation. The confirmation shows that a message was received. It is not a digest comparison, not a signature check, and not a registry allow-list.

Shu, Gu, and Enck (2017) report known vulnerabilities in many public images. Their study is not this clinic's registry, and none of their counts is copied here. Jacobs and colleagues (2021) define EPSS for a known vulnerability identifier. This file has no such identifier, so the score is undefined. Rahman, Parnin, and Williams (2019) discuss smells in infrastructure-as-code scripts. No such script is in either lab, so those smells are not results for the booking app.

SP 800-190 recommends maintained bases and trusted registries. The email does not perform those checks. Burns and colleagues (2016) and Verma and colleagues (2015) describe cluster managers. Oakfield's platform is the simpler host already named, not a Borg cell and not a Kubernetes cluster. No node count is recorded. Oakfield's month-end sentence remains in chapter 4, and this lesson does not reprint it as a new result.

14.2 Worked example

Lesson table; scroll horizontally to read all columns →

Synthetic case. The developer stays unnamed. The image stays unnamed.

Errors and limits

A year without a rebuild is a lag. It is not a table of flaws.

Apply

• EX060 — Age versus count. A classmate attaches a vulnerability total, an EPSS value, a digest, and a cluster size to the year-old image. What can the note keep?
  Show marking criteria

  Rubric: 3 = keep the year-old base and the monthly confirmation; reject the total, the score, the digest, and the cluster size; the platform is not Kubernetes;; 2 = keep the age and reject the measurements;; 1 = one item;; 0 = none.