NanoClaw just wiped 1,400 CVEs from their container images

Security scanners are usually a nightmare because they scream about a thousand vulnerabilities, and 90% of them are "noise" from bloated base images. NanoClaw actually managed to kill 1,400 CVEs in their images, which is a massive win for anyone who cares about a tight attack surface. Most teams just ignore the scanner reports because fixing them is a rabbit hole of dependency hell, but this scale of reduction suggests they went for a radical architectural shift rather than just running apt-get upgrade in a loop.

How to actually shrink your attack surface

If you're trying to replicate this kind of cleanup for your own deployment, you can't just patch your way out of it. You have to change how you build. The most effective way to hit these numbers is moving toward distroless images or extremely minimal bases like Alpine, but even that isn't enough if your application layers are messy.

1. Audit the Base Image
Stop using ubuntu:latest or node:latest for production. These are packed with shells, package managers, and utilities that a running binary doesn't need. Switch to a -slim variant or a distroless image. If the binary doesn't need a shell to run, don't give it one.

2. Multi-stage Builds
This is the only way to keep your production image clean. Compile your code in a "build" container with all the heavy compilers and headers, then copy only the final artifact into a fresh, empty runtime image.

# Build stage
FROM golang:1.21-alpine AS builder
WORKDIR /app
COPY . .
RUN go build -o main .

# Final stage
FROM alpine:latest
WORKDIR /root/
COPY --from=builder /app/main .
CMD ["./main"]

3. Strip Unnecessary Packages
Check your RUN commands. Every time you install a tool to help with the build process, you're adding potential CVEs. If you must install a package, remove the cache and the package manager itself in the same layer.

The reality of CVE "Fixing"

We need to be skeptical about these numbers, though. Eliminating 1,400 CVEs often means you've removed the libraries that the scanner was flagging, not necessarily that you "fixed" a bug in the code. It's a valid strategy—if the code isn't there, it can't be exploited—but it's more about subtraction than repair.

The real challenge is the "unfixable" CVEs—the ones where a vulnerability exists but the maintainers haven't released a patch. In those cases, the only real solution is a deep dive into your AI workflow to see if the vulnerable function is even being called. If it isn't, you're just chasing ghosts.

For anyone doing a real-world deployment, the goal shouldn't be "zero CVEs" because that's impossible. The goal is a minimal image where every single byte has a reason for existing. That's how you actually secure a system instead of just satisfying a security auditor's checklist.