Container Security
In-depth guides and analysis on container security from the Safeguard engineering team.
284 articles
Startups vs Enterprises: Why Smaller Cloud Footprints Are...
Smaller cloud footprints feel safer, but startups often face a higher per-workload security incident rate than enterprises. Here's why size is the wrong safety proxy.
Sidecar Proxies and the Expanding Attack Surface of Servi...
Sidecar proxies like Envoy quietly double your cluster's attack surface. Real CVEs from 2023–2024 show how mesh sidecars get exploited — and how to actually secure them.
Runtime Detection vs Static Scanning: Closing the Cloud-t...
Static scanners miss what only shows up at runtime. See why the cloud-to-code visibility gap causes months-long breach dwell times, and how to close it.
The Cost Multiplier Effect of Fixing Vulnerabilities in P...
A misconfigured base image caught at build time costs minutes to fix. Found in production, the same CVE triggers incident response and audits.
Multi-Cloud Complexity as a Hidden Security Tax on Engine...
Multi-cloud isn't a strategy most teams chose — it's an accumulation. Here's where the hidden security tax of running AWS, Azure, and GCP together actually gets paid, and how to stop paying it.
Why Container Registries Are an Underexamined Supply Chai...
Registries decide what code actually runs in production, yet most security programs treat them as passive storage. Here's why that's a costly blind spot.
Top container security tools to evaluate
Comparing Safeguard and Mend.io on the dimensions that actually matter for container security: scanning engine transparency, air-gapped support, registry coverage, and product origin.
CVE-2026-42945: A Buffer Overflow in NGINX's Rewrite Module Reaches Into Your Kubernetes Clusters (May 2026)
Disclosed May 17, 2026 with public PoC and in-the-wild activity, CVE-2026-42945 is a buffer overflow in NGINX's ngx_http_rewrite_module. It affects core NGINX and the ingress controllers that wrap it, putting cluster ingress in scope.
Kubernetes 1.33 Security Deep Dive
Kubernetes 1.33 shipped with meaningful security changes: stronger admission controls, expanded structured authorization, and several deprecations that will affect production clusters.
Service Mesh for Supply Chain Policy Enforcement
Using Istio, Linkerd, and Cilium service mesh to enforce signed-artifact, SPIFFE identity, and provenance-aware policy in production clusters.
OSS container image scanning tools compared
Trivy finds CVEs fast and free. Safeguard compares how each handles fleet-wide inventory, triage, policy enforcement, and audit evidence at scale.
Container image scanning: how it works and best tools
A practical guide to container image scanning: how layer-by-layer CVE detection works, how Trivy stacks up, and where Safeguard adds deeper coverage.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.