A CONTAINER IMAGE CAN BE VULNERABILITY-FREE AND STILL NOT TRUSTWORTHY

Summary from the TLDR DevOps newsletter

A clean scan only covers known CVEs, while malicious code like the Nx Console compromise needs none.