It's not that bad. On my system, starting and cleaning up a Docker container costs about 800ms, whereas running wkhtmltopdf on the New York Times home page takes ~4sec.

You say this now. Just wait a few years when this is a common pattern for distributing cross-platform applications. I'd much rather start up an image than clutter my system with a pile of dependencies that I may need to even compile. No thanks.

Using docker means that you don't have to install any of these dependencies on your computer, and, if it's setup correctly, it runs sandboxes from the rest of my system. So it's not just about the "overhead".

Does docker have a single system to report included libraries up to management, so that when, for example, there's a major hole in openssl or nginx or a php library or the Chromium engine, I will immediately know which docker images are vulnerable and which I don't have to worry about?

Because until that happens, the only way I can run docker images is when I've created them myself... and even then I really need a tool that does the above, so that I can rebuild them when the next CVE comes around.

... so build them yourself. And keep them in your own repository. And build them on a base that you have analyzed. You can probably use whatever tooling you are using for that purpose today. They aren't voodoo.

Have you heard of Claire?

https://github.com/coreos/clair

Too much overhead for the occasional batch report from an embedded system. A replacement for wkhtmltopdf would be nice, though.

If you already have Docker running this is a no brainer. The Docker daemon is light weight and starting new containers takes milliseconds is the image is already on your machine (which gets auto-downloaded first run).

I think this is actually a great use of Docker.