“Even when you've got a package manager for the container, you have to start realizing, well, wait, am I using a package manager for my web app framework, for Ruby on Rails, or my package manager for Python, or my package manager, npm for JavaScript, and trying to track all of those?”

Transcript evidence from Jay Beale -- Docker Security and AppSec.