  [Context]: Containerization ensures the resilience of distributed
applications by Kubernetes. Helm is a package manager for Kubernetes
applications. A Helm package, namely "Chart'', is a set of pre-configured
resources that one could quickly deploy a complex application. However, Helm
broadens the attack surface of the distributed applications.
  [Objective]: This study aims to investigate the prevalence of fixable
vulnerabilities, the factors related to the vulnerabilities, and current
mitigation strategies in Helm Charts.
  [Method]: We conduct a mixed-methods study on 11,035 Helm Charts affected by
10,982 fixable vulnerabilities. We analyze the complexity of Charts and compare
the distribution of vulnerabilities between official and unofficial Charts.
Subsequently, we investigate vulnerability mitigation strategies from the
Chart-associated repositories by a grounded theory.
  [Results]: Our findings highlight that the complexity of a Chart correlates
with the number of vulnerabilities, and the official Charts do not contain
fewer vulnerabilities compared to unofficial Charts. The 10,982 fixable
vulnerabilities are at a median of high severity and can be easily exploited.
In addition, we identify 11 vulnerability mitigation strategies in three
categories. Due to the complexity of Charts, maintainers are required to
investigate where a vulnerability impacts and how to mitigate it. The use of
automated strategies is low as automation has limited capability(e.g., a higher
number of false positives) in such complex Charts.
  [Conclusion]: There exists need for automation tools that assist maintainers
in mitigating vulnerabilities to reduce manual effort. In addition, Chart
maintainers lack incentives to mitigate vulnerabilities, given a lack of
guidelines for mitigation responsibilities. Adopting a shared responsibility
model in the Helm ecosystem would increase its security.
