Nearly one in five of the most popular containers available on the Docker store have no password for root access. That’s the finding of researcher Jerry Gamblin, building on work by researchers at Cisco Talos. The result could easily be hundreds of thousands of containers deployed with no functional password at all.

The finding is important because containers, most frequently with Docker as the container manager, are becoming popular for deploying virtualized applications (as opposed to completed virtualized servers deployed with products like VMware or Microsoft Hyper-V). As Docker puts it, “A Docker container image is a lightweight, standalone, executable package of software that includes everything needed to run an application: code, runtime, system tools, system libraries, and settings.”