Containers
In-depth guides and analysis on containers from the Safeguard engineering team.
100 articles
Running Java in Docker: A Secure Dockerfile Walkthrough
A Java Docker container done right: multi-stage builds, a JRE not a full JDK, non-root users, JVM container-awareness, and a base image that does not ship the world.
Writing a Secure Node.js Dockerfile: Best Practices That Hold Up
A secure Node.js Dockerfile pins a specific base image, runs as a non-root user, and uses multi-stage builds to keep build tooling out of production. Here is a hardened template and why each line matters.
k8s securityContext: How to Lock Down Kubernetes Pods and Containers
The k8s securityContext is your first real control over what a container can do at runtime. A field-by-field guide to a hardened, non-root pod spec.
Docker Rebuild Strategies: Cache and Layers Done Right
Docker rebuild speed and security both come down to how you order layers and invalidate cache — get it wrong and you either wait ten minutes per build or ship stale, unpatched images.
Kubernetes Security Issues You Should Actually Worry About
The Kubernetes security issues that cause real breaches are rarely exotic zero-days. They are misconfigured RBAC, exposed dashboards, over-privileged pods, and unscanned images. Here is where to look first.
Dockerizing Node.js and PHP Apps: A Practical Guide
Writing a node js dockerfile and learning how to dockerize php application deployments both hinge on the same handful of decisions — base image, layer order, and what you leave out of the final image.
Rebuilding Docker Images: When and How
Knowing how to rebuild a Docker image correctly — and when a cached layer is silently serving stale, vulnerable code — matters more than most teams realize until a patch doesn't actually land.
Docker Scratch Images: When (and When Not) to Use Them
A docker scratch image starts from nothing — no shell, no package manager, no OS layer — which makes it the smallest possible attack surface, but only for binaries built to run without one.
Kubernetes securityContext: A Practical Hardening Guide
The securityContext in Kubernetes is where most pod hardening actually happens. A field-by-field guide to running non-root, dropping capabilities, and read-only roots.
How to Dockerize a PHP Application Without Shipping Vulnerabilities
Dockerizing a PHP application is easy; doing it securely takes a few deliberate choices about base images, users, and dependencies. Here is a hardened, production-ready approach.
Docker Image Security Scan: How to Scan Images for Vulnerabilities
A Docker image security scan inspects the layers of an image for known-vulnerable packages before you ship it. Here are the tools, commands, and the workflow that keeps scanning useful.
Kubernetes runAsUser: How to Run Containers as a Non-Root User
What the Kubernetes runAsUser security context does, how to set it correctly, and the common mistakes that quietly leave pods running as root.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.