@yojimbo @lightweight @JulianOliver That's a fair point! I figured starting with a broader base would help with the user namespace explanation, particularly because of all the users that are already built into the image. Also, from a teaching perspective, perhaps starting from ubuntu as a base might be more "accessible" to a newcomer's mental model of containers than jumping straight ahead to distroless/scratch. The exploit overview builds from the rootless/namespaces overview so I decided to stick with that for consistency. To your point, had the article focused solely on the hardening aspect, then yes, starting with a much smaller image would've been preferable.