What are the primary security risks of running unpatched base images in our Docker containers and how do we mitigate them?