We also have to see what this "hardened" in the end really means. Already we have a base image from a well known Ubuntu state and unlike with many upstream docker images we are not blindly updating those base layers during a rebuild, which could potentially pull in malicious broken packages.
If at all, I would be lots more worried about the actual apps, which pull in GBs of modules from like npm (looking at those nextjs apps...)
S
