One current vulnerability is the ability to inject a newline character
into Dockerfile output. Currently, a yaml file like:

base: debian:jessie
apt:
  packages: [libjpeg, libyaml, "\n RUN touch /bin/hello-world"]

Results in a dockerfile with the line:

RUN touch /bin/hello-world

This provides a new function that escapes instructions