container-security
Safeguard articles tagged "container-security" — guides, analysis, and best practices for software supply chain and application security.
446 articles
Rebuilding Docker Images: When and How
Knowing how to rebuild a Docker image correctly — and when a cached layer is silently serving stale, vulnerable code — matters more than most teams realize until a patch doesn't actually land.
Docker Scratch Images: When (and When Not) to Use Them
A docker scratch image starts from nothing — no shell, no package manager, no OS layer — which makes it the smallest possible attack surface, but only for binaries built to run without one.
How to Dockerize a PHP Application Without Shipping Vulnerabilities
Dockerizing a PHP application is easy; doing it securely takes a few deliberate choices about base images, users, and dependencies. Here is a hardened, production-ready approach.
Is node:18-alpine Still Safe to Use in 2025?
The node:18-alpine image is small and popular, but Node.js 18 reached end of life in April 2025. Here is what that means for your containers and how to migrate cleanly.
Kubernetes runAsUser: How to Run Containers as a Non-Root User
What the Kubernetes runAsUser security context does, how to set it correctly, and the common mistakes that quietly leave pods running as root.
Docker Hub Node Images: Choosing and Securing the Right Node Tag
The official Node image on Docker Hub ships in half a dozen flavors, and the tag you pick changes your attack surface far more than most teams realize.
node:20-alpine: Is the Small Image Worth the Tradeoffs?
node:20-alpine gives you the smallest mainstream Node.js base image, but musl libc and a stripped userland come with real caveats. Here is when to use it and how to harden it.
org.opencontainers.image.source: OCI Labels for Provenance
The org.opencontainers.image.source label ties a container image back to the repository that built it — a small string with outsized value for provenance, registry linking, and supply chain security.
Kubernetes SecurityContext, Field by Field
SecurityContext in Kubernetes is where pod and container hardening actually lives — here's what each field controls and which defaults you should never leave in place.
Kubernetes Security in 2026: CVEs and Hardening Priorities
The CVEs that hurt clusters lately live at the edges: admission controllers, ingress, and image supply chains. What the recent record says about where to harden first.
PHP Docker: How to Build a Secure PHP Docker Image
A secure PHP Docker setup starts with a supported base tag, a slim image, a non-root user, and a scanned dependency tree. Here is how to get all four.
JFrog Xray vs Prisma Cloud: A 2026 Comparison
Where JFrog Xray and Prisma Cloud actually compete, where they don't, and how to pick between them for software supply chain and runtime security in 2026.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.