I’ve been trying out deploying Roon to Docker on my UGreen NAS and it is working well. I’m using DockHand which has a nice feature where it will scan docker images with grype and trivey. I had it scan the latest Package roonserver · GitHub
and it found half a dozen “critical” and 20-30 “high” vulnerabilities. I can send a screenshot of the list if you like.
Should I be concerned?
Thank you!
-Brian
Paging @Stephen
I’m not seeing any critical when using trivy.
$ trivy image ghcr.io/roonlabs/roonserver
2026-04-27T12:09:23+01:00 INFO [vulndb] Need to update DB
2026-04-27T12:09:23+01:00 INFO [vulndb] Downloading vulnerability DB...
2026-04-27T12:09:23+01:00 INFO [vulndb] Downloading artifact... repo="mirror.gcr.io/aquasec/trivy-db:2"
91.51 MiB / 91.51 MiB [-----------------------------------------------------------------------------------------] 100.00% 14.78 MiB p/s 6.4s
2026-04-27T12:09:30+01:00 INFO [vulndb] Artifact successfully downloaded repo="mirror.gcr.io/aquasec/trivy-db:2"
2026-04-27T12:09:30+01:00 INFO [vuln] Vulnerability scanning is enabled
2026-04-27T12:09:30+01:00 INFO [secret] Secret scanning is enabled
2026-04-27T12:09:30+01:00 INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2026-04-27T12:09:30+01:00 INFO [secret] Please see https://trivy.dev/docs/v0.70/guide/scanner/secret#recommendation for faster secret detection
2026-04-27T12:09:34+01:00 INFO Detected OS family="debian" version="13.4"
2026-04-27T12:09:34+01:00 INFO [debian] Detecting vulnerabilities... os_version="13" pkg_num=126
2026-04-27T12:09:34+01:00 INFO Number of language-specific files num=0
2026-04-27T12:09:34+01:00 WARN Using severities from other vendors for some vulnerabilities. Read https://trivy.dev/docs/v0.70/guide/scanner/vulnerability#severity-selection for details.
Report Summary
┌───────────────────────────────────────────┬────────┬─────────────────┬─────────┐
│ Target │ Type │ Vulnerabilities │ Secrets │
├───────────────────────────────────────────┼────────┼─────────────────┼─────────┤
│ ghcr.io/roonlabs/roonserver (debian 13.4) │ debian │ 265 │ - │
└───────────────────────────────────────────┴────────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)
ghcr.io/roonlabs/roonserver (debian 13.4)
Total: 265 (UNKNOWN: 1, LOW: 119, MEDIUM: 113, HIGH: 32, CRITICAL: 0)
But, let’s be clear, these are potential vulnerabilities affecting Debian 13 components. You see similar reports for other Docker images. For example …
To reiterate, these vulnerabilities are not unique to the Roon container image, and would also apply to Debian Stable and other flavours of Linux using the same version of Python, FFmpeg etc.
Moreover, the scans may not be entirely up-to-date, For instance, CVE-2026-6100 isn’t listed on Aqua and is awaiting enrichment on NIST, i.e., it isn’t scored, so your dashboard may be marking such examples as critical when this isn’t the case.
OSS developers tend to use OSV, which aggregates issues from many sources, and fix issues according to risk and impact.
For instance, one of those you list is already fixed. However, Docker images are not updated in the same way as the host OS, which is why security scans are performed (in a commercial context) to mitigate risk.
However, Roon server isn’t public facing, so most vulnerabilities carry little or no risk. Of course, the recent changes to Roon OS, Roon Server etc. addressing SSL would likely have resulted in a new Docker image.
You should not be concerned.
@mjw is correct. I do plan on paying attention to these things though.
Thank you everyone!
