So this new Chrome zero-day got me paranoid about our headless browser containers. Started auditing and found a PDF generation service running a Chrome image from early 2023. Thing's been chugging along in prod this whole time, processing user uploads.

Makes you wonder what else is lurking out there. Base images get forgotten so easily once they're working. Now I'm writing a policy to flag anything over 6 months old for review.