container-security
Safeguard articles tagged "container-security" — guides, analysis, and best practices for software supply chain and application security.
446 articles
Aqua Vulnerability Database (AVD) explained
AVD powers Trivy's scan results, but it's a curated aggregator, not a primary source. Here's how it differs from NVD, where its gaps are, and how to close them.
CNAPP according to Gartner: capabilities and evaluation c...
Gartner's CNAPP framework demands unified risk correlation, not bundled scanners. Here's how Trivy (Aqua) maps to it — and where supply chain security closes the gap.
Container image scanning: how it works and best tools
A practical guide to container image scanning: how layer-by-layer CVE detection works, how Trivy stacks up, and where Safeguard adds deeper coverage.
Container security best practices checklist
A practical container security checklist covering base images, scanning limits, runtime risk, and why CVE scans like Trivy alone miss most real supply chain threats.
Docker CIS Benchmark: what it checks and how to pass it
A practical breakdown of what the CIS Docker Benchmark actually checks, why Trivy alone only covers part of it, and how to remediate and stay compliant.
Container escape attacks: how they happen and how to prev...
Container escapes rarely need a zero-day — privileged flags, mounted sockets, and excess capabilities do the job. Here's how they happen, real CVEs, and how to stop them.
How .dockerignore Protects Your Builds: A Security Guide
A well-written docker ignore file keeps secrets, git history, and local cruft out of your images — one of the cheapest and most overlooked container security wins.
Kubernetes Security Risks: The Threats That Actually Matter
The real Kubernetes security risks are misconfiguration, over-permissive RBAC, exposed control planes, and vulnerable images, not exotic zero-days. Here's how to prioritize.
Docker Privileged Mode: What --privileged Really Grants and Safer Options
Docker Compose privileged mode hands a container nearly all host capabilities. Here is what --privileged actually turns on, and the scoped alternatives that do the same job safely.
Docker Privileged Containers: `docker run` and Compose Risks
docker run privileged and docker compose privileged both hand a container root-equivalent access to the host — here's exactly what that means and when, if ever, it's justified.
How to reduce alert fatigue from vulnerability scanners
Container scanners like Trivy can return thousands of CVE findings per scan. Here's why most are noise, and how reachability and exploit data cut the list to what matters.
Kubernetes securityContext: fsGroup and the Fields People Skip
A field-by-field walkthrough of Kubernetes securityContext — fsGroup, runAsNonRoot, and the settings teams leave at their insecure defaults.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.