Containers
In-depth guides and analysis on containers from the Safeguard engineering team.
100 articles
Docker Compose: Rebuilding Images Correctly (and Catching Stale Layers)
Why docker compose up sometimes runs old code, and how to rebuild images so what runs matches what you edited, including cache, stale layers, and orphaned images.
Docker Hub Node.js Images: How to Pick and Harden the Right Tag
The official Docker Hub Node.js images come in a dozen variants, and the tag you choose decides your image size, patch cadence, and attack surface. Here is how to read them.
Kubernetes CVE News: How to Track and Respond to Cluster Vulnerabilities
Where Kubernetes CVE news actually breaks, how to read a cluster advisory, and a repeatable process for triaging vulnerabilities before they turn into an incident.
Writing a Secure Kubernetes Dockerfile: A Practical Hardening Guide
The Dockerfile you write decides most of a pod's attack surface before Kubernetes ever schedules it. Here is how to build images that run non-root, stay small, and survive a security review.
How Does a Kubernetes Security Breach Happen and How Do You Prevent One?
Most Kubernetes security breaches trace back to exposed dashboards, leaked credentials, and over-permissive RBAC. Here is how the real attacks unfolded and what stops them.
Node Docker Images: Picking the Right Base for Production
The node docker image you pick as a base determines most of your container's attack surface and size. Here's how to choose between full, slim, and alpine variants for production.
What a Cloud Native Security Platform Actually Does
A cloud native security platform unifies posture, workload, and supply chain controls for containerized apps. Here is what the category covers and how to tell the marketing from the substance.
Python Dockerfile Best Practices for Secure, Small Images
The Python Dockerfile best practices that matter most for security are running as a non-root user, choosing a slim base, using multi-stage builds, and pinning dependencies. Here is a working reference Dockerfile and why each line is there.
Python Docker Images: How to Choose a Secure, Slim Base
Choosing among Python Docker images comes down to trade-offs between size, glibc compatibility, and attack surface. Here is how the official tags differ and how to build a lean, low-CVE image.
Kubernetes SecurityContext Capabilities: Drop vs Add
Kubernetes securityContext capabilities let you strip Linux kernel privileges from a container instead of accepting the runtime default set — here's when to drop, when to add back, and why dropping ALL first is the right starting point.
How .dockerignore Protects Your Builds: A Security Guide
A well-written docker ignore file keeps secrets, git history, and local cruft out of your images — one of the cheapest and most overlooked container security wins.
Kubernetes Security Risks: The Threats That Actually Matter
The real Kubernetes security risks are misconfiguration, over-permissive RBAC, exposed control planes, and vulnerable images, not exotic zero-days. Here's how to prioritize.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.