Most secure data engineering and ML container images, ranked by isolation score¶
How isolated are the most-pulled data engineering and ML container images when you docker run them with plain defaults, no hardening flags? This page ranks 14 data pipelines, analytics, and ML platforms (Airflow, Spark, Flink, MLflow, Jupyter) on IronClaw's seven-dimension container containment scale (0-100), best-isolated first. Scores run 48/100 to 63/100 (average 54/100). Higher is safer. Every score comes from ironctl scan, a credential-free audit you can run on your own containers in ten seconds.
No data engineering and ML image ships fully isolated by default: the leaders still leave capabilities, egress, or a writable root filesystem open. The gap between any image here and a clean 100/100 grade A is a handful of
docker runflags, shown on every scorecard.
Ranked best to worst¶
| Rank | Image | Score | Grade | Top gaps (default config) |
|---|---|---|---|---|
| 🥇 1 | apache/airflow:2.10.4 |
63/100 | 🟡 C | Dropped capabilities, Network isolation / egress, Read-only root filesystem |
| 🥈 2 | quay.io/jupyter/base-notebook:latest |
63/100 | 🟡 C | Dropped capabilities, Network isolation / egress, Read-only root filesystem |
| 🥉 3 | apache/nifi:2.0.0 |
63/100 | 🟡 C | Dropped capabilities, Network isolation / egress, Read-only root filesystem |
| 4 | apache/spark:3.5.3 |
63/100 | 🟡 C | Dropped capabilities, Network isolation / egress, Read-only root filesystem |
| 5 | apache/superset:4.1.1 |
63/100 | 🟡 C | Dropped capabilities, Network isolation / egress, Read-only root filesystem |
| 6 | apache/zeppelin:0.11.2 |
63/100 | 🟡 C | Dropped capabilities, Network isolation / egress, Read-only root filesystem |
| 7 | flink:1.20 |
48/100 | 🟠 D | Dropped capabilities, Non-root user (uid != 0), Network isolation / egress |
| 8 | jupyterhub/jupyterhub:5.2.1 |
48/100 | 🟠 D | Dropped capabilities, Non-root user (uid != 0), Network isolation / egress |
| 9 | metabase/metabase:v0.52.4 |
48/100 | 🟠 D | Dropped capabilities, Non-root user (uid != 0), Network isolation / egress |
| 10 | ghcr.io/mlflow/mlflow:v2.19.0 |
48/100 | 🟠 D | Dropped capabilities, Non-root user (uid != 0), Network isolation / egress |
| 11 | ollama/ollama:0.5.4 |
48/100 | 🟠 D | Dropped capabilities, Non-root user (uid != 0), Network isolation / egress |
| 12 | rocker/rstudio:4.4.2 |
48/100 | 🟠 D | Dropped capabilities, Non-root user (uid != 0), Network isolation / egress |
| 13 | storm:2.7.1 |
48/100 | 🟠 D | Dropped capabilities, Non-root user (uid != 0), Network isolation / egress |
| 14 | tensorflow/tensorflow:2.18.0 |
48/100 | 🟠 D | Dropped capabilities, Non-root user (uid != 0), Network isolation / egress |
Scan your own data engineering and ML container¶
These grades come from ironctl scan, one credential-free command that audits any running container, docker-compose service, or Kubernetes manifest, not just the data engineering and ML images ranked above:
# install (Homebrew)
brew install ironsecco/ironclaw/ironclaw
# grade your own container the same way this page was generated
ironctl scan my-container
- All container isolation scores →, every scorecard, worst-isolated first.
- Browse every category →, the full set of ranked collection pages.
- Container Isolation Leaderboard →, the whole dataset ranked, with a Hall of Fame and worst offenders.
- Scan any container →, the full command reference.
- The State of Container Isolation, 2026 →, the survey these grades are built from.
Part of the Container Isolation Scores directory. Generated from a reproducible survey by examples/isolation-survey/gen_scorecards.py and refreshed weekly, so this ranking never goes stale. Grades reflect each image's default configuration, not a limit of the image itself: every one reaches grade A with the right docker run flags.