Containers
In-depth guides and analysis on containers from the Safeguard engineering team.
100 articles
Docker Image Scanning: How It Works and What It Finds
Scanners don't run your container — they unpack it. How docker image scanning inventories layers, matches CVEs, handles distro backports, and where it belongs in your pipeline.
Docker Security Concerns: The Real List
Docker security concerns that actually cause incidents are narrower than most checklists suggest — root-by-default containers, exposed daemon sockets, and unpatched base images account for most real-world breaches.
Docker Vulnerability News: What Recent Container CVEs Mean for You
Keeping up with Docker vulnerability news matters because container escapes turn a compromised app into a compromised host. Here is how to read the headlines and act on them.
Kubernetes Ingress TLS: Setup, Certificates, and Common Mistakes
How Ingress TLS works in Kubernetes: terminating HTTPS at the ingress, wiring TLS secrets, automating certificates with cert-manager, and the mistakes that break it.
Docker Images Format Explained: Layers, OCI, and Security
Understanding the Docker images format, from layers and manifests to the OCI spec, is the foundation for scanning, signing, and hardening what you ship.
Choosing a Docker Security Tool: What Actually Matters
A Docker security tool scans images, configs, and running containers for risk. Here is what each category covers and how to pick one that fits your workflow.
Dockerfile Best Practices: Security, Size, and Build Speed
Most Dockerfiles are copy-pasted from a tutorial and never revisited. Here's what actually shrinks image size, closes the common security holes, and speeds up rebuilds.
Docker Laravel Security: Hardening Your PHP Container from Base Image to Runtime
A security-focused guide to running Laravel in Docker — non-root PHP-FPM, multi-stage builds, secret handling, and locking down the layers that leak.
Tracking Kubernetes CVEs in 2026: A Practical Method
Kubernetes CVE news moves fast across control plane, kubelet, and CNI components — here's a repeatable method for tracking what actually applies to your cluster.
Docker LABEL: A Security and Metadata Guide
How the Docker LABEL instruction works, the OCI annotation conventions worth adopting, and how good labels make image supply chains auditable.
How to Pull and Secure a Node Image from Docker Hub
The official Docker Hub node image ships in several variants that differ wildly in size and CVE count. Here is how to pick one and lock it down.
k8s fsGroup: How Kubernetes Sets Volume Ownership Securely
What k8s fsGroup actually does to volume permissions, why it can wreck pod start times, and how to configure it without opening a privilege gap.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.