Containers
In-depth guides and analysis on containers from the Safeguard engineering team.
100 articles
Kubernetes Security News Today: What to Watch and How to Respond
Keeping up with Kubernetes security news today means more than reading headlines. Here's how to triage a fresh CVE, what IngressNightmare taught us, and where to look first.
Docker Vulnerability Scanners: What They Catch and Miss
Image scanners are excellent at matching OS packages and language dependencies against CVE databases — and structurally blind to config flaws, runtime behavior, and code you compiled yourself. Where the line sits.
How to Build a Docker Image for Kubernetes Securely
You do not build Docker images inside Kubernetes the old way anymore. Here are the secure patterns for building images that k8s will run, from CI to in-cluster builders.
Docker Scratch Image: The Security Case for Empty Bases
A Docker scratch image starts from nothing, and that emptiness is the point: no shell, no package manager, and almost no CVEs for a scanner to find.
Docker Security Scanning: How to Find Vulnerabilities in Your Images
Docker security scanning inspects your container images for known-vulnerable OS and application packages before they reach production. Here is how it works and how to wire it into your pipeline.
Node.js in Docker: A Practical Setup Guide
A practical setup guide for running node.js docker containers in production, choosing between docker node slim and full images, and locking down what actually matters for security.
Kubernetes Network Policy Best Practices for a Zero-Trust Cluster
The core Kubernetes network policy best practice is to default-deny all traffic and then explicitly allow only what each workload needs. Here is how to build that model without breaking your cluster.
K8s Admission Controllers: Enforcing Policy at the Kubernetes API
A k8s admission controller intercepts every request to the API server and can validate or mutate it, making it the natural enforcement point for security policy.
Golang Docker Images: Building Them Right
How to build Golang Docker images that stay small, patch cleanly, and don't ship a compiler toolchain into production, using multi-stage builds done properly.
Docker Isolation: How Containers Actually Separate Workloads
Docker isolation relies on Linux namespaces, cgroups, and capabilities, not a hypervisor. Here is what that really protects and where the boundary is weaker than teams assume.
Writing a Container Security Policy That Actually Holds
Most container security policies get written once, ignored during the next sprint, and rediscovered during an audit — here's how to write one that engineers actually follow.
Kubernetes SecurityContext: The Settings That Matter
A pod's securityContext decides whether a compromised container is contained or a launchpad. Here are the fields that actually reduce blast radius — and the copy-paste block that sets a hardened baseline.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.