I honestly think you're better off with RHEL. They might have been slow to act in this situation, but do one scan on a Debian vs a RHEL system container image and I'm confident Debian's will show a lot more red than RHEL (even with the fedora)
I remember RHEL being quite slow with copyfail as well. It'd be nice to have some more comprehensive statistics though.
And I don't put a lot of faith in container scans as a metrics. (More properly, I don't have faith in most containers scanners to properly identify package versions and backports.)
I'm sticking with the RHEL ecosystem for now, but it's now more out of inertia than a feeling that I gain much by it being the corporate standard. It's gone from "by choice" to "by habit".
