but seeing that I had already started looking into security issues, I started checking the images I run with trivy and was surprised by the high number of findings. I had a look at your Dockerfile and its based upon: tomcat:jdk15-openjdk-slim-buster so I was wondering if that is no longer being maintained?
The latter findings (see below) are obviously are on Guacamole's side not much we can do about them.
Here is a quick overview of the findings, without going into the details I am just wondering why maxwaldorf/guacamole:1.3 has way more vulnerabilities than its base image tomcat:jdk15-openjdk-slim-buster?
tomcat:jdk15-openjdk-slim-buster (debian 10.9)
==============================================
Total: 126 (UNKNOWN: 0, LOW: 14, MEDIUM: 49, HIGH: 51, CRITICAL: 12)
maxwaldorf/guacamole:1.3 (debian 10.7)
======================================
Total: 2108 (UNKNOWN: 2, LOW: 170, MEDIUM: 1000, HIGH: 789, CRITICAL: 147)
app/guacamole/extensions-available/guacamole-auth-duo-1.3.0.jar
===============================================================
Total: 1 (UNKNOWN: 0, LOW: 1, MEDIUM: 0, HIGH: 0, CRITICAL: 0)
app/guacamole/extensions-available/guacamole-auth-ldap-1.3.0.jar
================================================================
Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)
app/guacamole/extensions-available/guacamole-auth-totp-1.3.0.jar
================================================================
Total: 1 (UNKNOWN: 0, LOW: 1, MEDIUM: 0, HIGH: 0, CRITICAL: 0)
app/guacamole/extensions/guacamole-auth-jdbc-postgresql-1.3.0.jar
=================================================================
Total: 2 (UNKNOWN: 0, LOW: 1, MEDIUM: 0, HIGH: 1, CRITICAL: 0)
usr/local/tomcat/webapps/ROOT.war
=================================
Total: 2 (UNKNOWN: 0, LOW: 1, MEDIUM: 0, HIGH: 1, CRITICAL: 0)