container-security
Safeguard articles tagged "container-security" — guides, analysis, and best practices for software supply chain and application security.
446 articles
Kubernetes admission controller
A Kubernetes admission controller intercepts API requests before they're persisted, enforcing policy on Pods, images, and configs before workloads ever run.
Kubernetes Network Policies: The Supply Chain Angle
Network policies are usually framed as a zero-trust tool. They are also one of the best defenses against a compromised dependency.
How to configure Kubernetes network policies
A step-by-step guide to configuring Kubernetes network policies: enabling Calico, building a default-deny baseline, allow-listing traffic, and verifying enforcement.
GCP Cloud Run Supply Chain Security
A practical playbook for protecting the supply chain of services running on Cloud Run: image provenance, Binary Authorization, runtime identity, and the gaps the default configuration leaves wide open.
How to Secure Container Software: A Practical Guide
Securing container software means controlling the whole chain, base image, dependencies, build, registry, and runtime, not just scanning the final image. Here is a working model for each layer.
Wolfi OS: The Linux Distribution Built for Secure Containers
Wolfi is not a general-purpose Linux distro. It exists to solve one problem: provide secure, minimal, up-to-date packages for container images. Here is why that matters and how to use it.
How to scan container images for vulnerabilities with Trivy
Learn how to scan container images with Trivy: install it, run your first scan, filter by severity, and gate builds automatically in CI/CD pipelines.
Prisma Cloud Container Security: Palo Alto's Cloud Native Play
A review of Prisma Cloud's container and cloud workload security features, covering image scanning, runtime protection, compliance, and the Twistlock heritage.
How to implement Kubernetes Pod Security Standards
A step-by-step guide to implementing Kubernetes Pod Security Standards, from auditing pods to enforcing restricted mode and migrating off PSP.
How to Run a Rocky Linux Container Scan Correctly
A Rocky Linux container scan only produces accurate results when your scanner reads Rocky's own advisory feed instead of guessing from RHEL or CentOS data.
Signing Container Images: Cosign, Notary, and Why It Matters
Signing container images cryptographically proves an image came from a trusted build and hasn't been tampered with since — here's how Cosign and Notary do it, and why registries alone can't guarantee that.
What Is a Docker Container? A Practical Explanation
A Docker container is a lightweight, isolated unit that packages an app with everything it needs to run — here's what that actually means under the hood and why it matters for security.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.