Containers
In-depth guides and analysis on containers from the Safeguard engineering team.
100 articles
Docker Meaning: What Docker Is and Why It Matters for Security
Docker packages an application and everything it needs into a portable container that runs the same everywhere. Understanding that model is the first step to securing it.
Docker Ubuntu Image: How to Use It Securely and Keep It Slim
The Docker Ubuntu image is a fine base, but a naive Dockerfile ships a bloated, vulnerable container. Here is how to pin, slim, and scan it properly.
Kubernetes Security Tools: What to Use and Why
A Kubernetes security tool covers one slice of cluster risk — image scanning, admission control, runtime detection, or posture. Here is how to combine them.
How to Scan a Docker Image with Snyk (and What It Misses)
A practical guide to scanning a Snyk Docker image for vulnerabilities: the CLI workflow, base-image advice, free-tier limits, and where container scanning needs a second look.
How to Write a Kubernetes Security Policy That Holds Up
A Kubernetes security policy is the set of enforced rules that decide what workloads may run and how. This guide covers Pod Security Standards, admission control, and turning intent into rules the cluster actually enforces.
Running Node.js on Ubuntu in Docker, Securely
A guide to the Node Ubuntu Docker pattern: when an Ubuntu base makes sense for Node.js, how to build it safely, and the security trade-offs versus slim images.
k8s Pod Security Policy: Why It Was Removed and What Replaced It
The k8s Pod Security Policy was deprecated in 1.21 and removed in 1.25. Here is why it went away and how to migrate to Pod Security Admission and Standards.
Docker Architecture Explained: A Security-Focused Breakdown
Docker architecture is a client-server system built on the daemon, containerd, images, and the kernel features that isolate containers. Here is how the pieces fit and where the security lines are.
Docker Scanners: Comparing the Image-Scanning Options
A docker scanner has to check three separate layers — base OS packages, application dependencies, and the Dockerfile itself — and most tools are genuinely strong at only one or two.
Scanning Docker Images for Vulnerabilities: How To
Knowing how to scan Docker images for vulnerabilities before they ship is the difference between catching a known CVE in CI and finding it in an incident report.
Choosing a Container Security Scanner
A practical checklist for choosing a container security scanner, covering base-image coverage, registry integration, runtime relevance, and how scan noise actually gets managed.
Docker Privileged Mode: What It Unlocks and Why to Avoid It
One flag, --privileged, hands a container almost the same power as root on the host. Here is exactly what it turns on, why it breaks isolation, and the narrow capabilities that replace it.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.