container-security
Safeguard articles tagged "container-security" — guides, analysis, and best practices for software supply chain and application security.
446 articles
Kubernetes CVE-2024-3177: Bypassing Mountable Secrets Policy
A medium-severity Kubernetes vulnerability allowed pods to access secrets they should not have been able to mount, undermining RBAC-based secret isolation in multi-tenant clusters.
How to set up Kubernetes RBAC
A step-by-step kubernetes RBAC setup guide covering Roles, RoleBindings, service accounts, least-privilege patterns, and how to verify and troubleshoot access.
How to encrypt Kubernetes secrets at rest
A step-by-step guide to encrypting Kubernetes secrets at rest: choosing a KMS provider, configuring etcd encryption, re-encrypting existing secrets, and verifying it worked.
Kubernetes Secrets Encryption Providers Reviewed
etcd encryption at rest finally works out of the box. The question is which provider you use, and the trade-offs have sharpened in 2024.
gVisor Runtime Security Deep Dive
gVisor intercepts syscalls in userspace and implements a minimal kernel in Go. It is a genuinely different approach, with genuinely different trade-offs.
How to configure Falco for runtime security monitoring
A practical walkthrough to configure Falco runtime security in Kubernetes: install, customize rules, route alerts, tune noise, and verify detection end-to-end.
Multi-Stage Docker Builds: The Security Implications Nobody Talks About
Multi-stage builds reduce image size, but they also introduce security considerations around build secrets, layer caching, and dependency leakage.
Best Container Security Tools in 2026
Image scanners, runtime sensors, and Kubernetes posture tools each catch different failures. Here is how the leading options compare in 2026 — and how to pick a stack without buying three overlapping scanners.
Container-Specific Vulnerability Management Tools, Compared
A field guide to container-specific vulnerability management tools: what Trivy, Grype, Clair, Docker Scout, and Anchore actually catch, and where each falls short.
OSS Container Security: What Changes With Open-Source Base Images
Open-source base images change your patch cadence, your license exposure, and your provenance story — here's what OSS container security actually adds on top of standard image hardening.
Container Security Vulnerabilities: How to Find and Fix Them
The container security vulnerabilities that actually get exploited, where they hide across the image lifecycle, and a practical order for fixing them without rebuilding everything at once.
How to Choose a Container Scanning Tool That Actually Helps
A practitioner's guide to picking a container scanning tool: what it should detect, where it fits in the pipeline, and how to avoid drowning in false positives.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.