  Software containers greatly facilitate the deployment and reproducibility of
scientific data analyses in various platforms. However, container images often
contain outdated or unnecessary software packages, which increases the number
of security vulnerabilities in the images, widens the attack surface in the
container host, and creates substantial security risks for computing
infrastructures at large. This paper presents a vulnerability analysis of
container images for scientific data analysis. We compare results obtained with
four vulnerability scanners, focusing on the use case of neuroscience data
analysis, and quantifying the effect of image update and minification on the
number of vulnerabilities. We find that container images used for neuroscience
data analysis contain hundreds of vulnerabilities, that software updates remove
about two thirds of these vulnerabilities, and that removing unused packages is
also effective. We conclude with recommendations on how to build container
images with a reduced amount of vulnerabilities.
