Containers
In-depth guides and analysis on containers from the Safeguard engineering team.
100 articles
Docker Image Labels: Metadata That Actually Matters
Docker image labels are free-form key-value metadata that, used well, drive SBOM generation, ownership tracing, and vulnerability triage — used poorly, they're just clutter in the Dockerfile.
Docker Image for Node: Choosing Slim vs Full Builds
The default node image on Docker Hub ships a full Debian userland most services never touch — knowing when slim, alpine, or distroless actually pays off keeps builds smaller without breaking native modules.
How to List Images in a Docker Registry (and Why the CLI Cannot)
To list images in a Docker registry you query the Registry HTTP API v2 directly, because the docker CLI has no command to enumerate a remote registry. Here is how to do it, and how to lock the endpoint down.
Container Image Security Tools, Compared
A container image security tool scans layers, packages, and configuration inside an image before and after it ships — here's how the major approaches differ and what actually matters when picking one.
Container Security Testing Methods, Compared
Image scanning, runtime monitoring, and configuration auditing all count as container security testing, but they catch different things at different stages — here's how to combine them.
Kubernetes Pod Security Context: A Practical Hardening Guide
The Kubernetes pod security context controls the privileges your containers run with. Here is how to configure it, and how it relates to the retired PodSecurityPolicy.
Choosing a Docker Node Version: A Security Guide
The Docker Node version you pin decides your patch cadence, image size, and vulnerability exposure. Here is how to pick and maintain a Node base image safely.
Go and Docker: Building Secure Container Images
Go and Docker pair well because Go compiles to a static binary that fits in a tiny, near-empty image. This guide shows how to build that image securely.
How to Evaluate a Docker Security Company
Picking a Docker security company means judging vendors on the whole container lifecycle — image scanning, runtime, registry, and admission — not just the count of CVEs their scanner prints. Here is a buyer's checklist.
Kubernetes securityContext Capabilities: Drop ALL, Add Only What You Need
Linux capabilities are the privileges inside a container that attackers reuse after a breakout. Setting Kubernetes securityContext capabilities to drop ALL is the cheapest hardening you will do.
Kubernetes securityContext, Explained From Scratch
How security context in kubernetes actually works at the pod and container level, what kubernetes runasuser and capability drops do, and a sane default policy to start from.
Kubernetes Security Breaches: What Actually Happened in Real Incidents
Real Kubernetes security breaches rarely start with an exotic zero-day — exposed dashboards, misconfigured RBAC, and default credentials show up again and again.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.