3 is exactly the reason I've never bothered to try docker's offering; that definitely is a reason
It’s simple but pretty granular too… ‘if this python image gets a fix for a critical CVE that’s actively exploited, trigger a GitHub action to rebuild the app with the updated image