Containers
In-depth guides and analysis on containers from the Safeguard engineering team.
100 articles
Docker Hub Node Images: Choosing and Securing the Right Node Tag
The official Node image on Docker Hub ships in half a dozen flavors, and the tag you pick changes your attack surface far more than most teams realize.
Kubernetes SecurityContext, Field by Field
SecurityContext in Kubernetes is where pod and container hardening actually lives — here's what each field controls and which defaults you should never leave in place.
Docker Container Security: A Hardening Checklist
Most container breaches trace back to a handful of avoidable mistakes — root users, bloated images, exposed sockets, unscanned dependencies. This checklist closes them, image to runtime.
Kubernetes Security in 2026: CVEs and Hardening Priorities
The CVEs that hurt clusters lately live at the edges: admission controllers, ingress, and image supply chains. What the recent record says about where to harden first.
PHP Docker: How to Build a Secure PHP Docker Image
A secure PHP Docker setup starts with a supported base tag, a slim image, a non-root user, and a scanned dependency tree. Here is how to get all four.
Docker Node Alpine: When to Use the Slim Image
Node Alpine Docker images cut attack surface and pull times dramatically, but musl libc compatibility gaps mean they're not a drop-in replacement for every Node project.
Docker Compose: Rebuilding Images Correctly (and Catching Stale Layers)
Why docker compose up sometimes runs old code, and how to rebuild images so what runs matches what you edited, including cache, stale layers, and orphaned images.
Writing a Secure Kubernetes Dockerfile: A Practical Hardening Guide
The Dockerfile you write decides most of a pod's attack surface before Kubernetes ever schedules it. Here is how to build images that run non-root, stay small, and survive a security review.
Kubernetes CVE News: How to Track and Respond to Cluster Vulnerabilities
Where Kubernetes CVE news actually breaks, how to read a cluster advisory, and a repeatable process for triaging vulnerabilities before they turn into an incident.
Docker Hub Node.js Images: How to Pick and Harden the Right Tag
The official Docker Hub Node.js images come in a dozen variants, and the tag you choose decides your image size, patch cadence, and attack surface. Here is how to read them.
How Does a Kubernetes Security Breach Happen and How Do You Prevent One?
Most Kubernetes security breaches trace back to exposed dashboards, leaked credentials, and over-permissive RBAC. Here is how the real attacks unfolded and what stops them.
Node Docker Images: Picking the Right Base for Production
The node docker image you pick as a base determines most of your container's attack surface and size. Here's how to choose between full, slim, and alpine variants for production.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.