container-security
Safeguard articles tagged "container-security" — guides, analysis, and best practices for software supply chain and application security.
100 articles
Minimal, Non-Root Docker Images for Python: A Best-Practices Guide
CVE-2019-5736 let a malicious container overwrite the host runc binary via root access. Here's how multi-stage, non-root builds close that door for Python apps.
OCI Image Labels and Annotations: A Practical Guide to Provenance and SBOM Linkage
OCI defines 14 standard org.opencontainers.image.* annotation keys, but labels are unsigned metadata — anyone with build access can forge them.
The Node.js Image: A Security Guide to Docker Base Images
Choosing a Node.js image is a security decision, not just a size one. The tag you pick, alpine, slim, or distroless, and the version you pin decide most of your container's attack surface.
Kubernetes Network Policy Best Practices for a Zero-Trust Cluster
The core Kubernetes network policy best practice is to default-deny all traffic and then explicitly allow only what each workload needs. Here is how to build that model without breaking your cluster.
Best runtime container security tools
A practical comparison of runtime container security tools, from eBPF-based monitoring to commercial threat detection platforms, and what to weigh before buying.
TLS termination and cert-manager: a hardening guide for Kubernetes Ingress
IngressNightmare's CVSS 9.8 RCE showed that ingress-nginx's own admission webhook can be turned against cluster Secrets — here's how to configure TLS safely.
Container escape techniques and defense in depth
CVE-2024-21626 let a leaked file descriptor turn runc exec into host root. Here's how container escapes actually work — and the layers that stop them.
Best container base image hardening tools
A buyer's guide to container base image hardening tools -- comparing Chainguard, Distroless, DockerSlim, Red Hat UBI, Wolfi, and Bitnami on real strengths and limitations.
Docker image vulnerability scanning: best practices for CI/CD
Log4Shell hid in countless container images for years before scanning caught it. Here's how to scan base layers and gate builds before that happens again.
Container isolation mechanisms explained: namespaces, cgroups, seccomp, and gVisor
Docker's default seccomp profile blocks roughly 44 of the 300-plus Linux syscalls, yet a 2019 runc escape bypassed every default namespace boundary anyway.
Best practices for containerizing .NET applications securely
.NET 8 gave containers a built-in non-root user and chiseled images that cut one team's CVE count 92% — most Dockerfiles still don't use either.
Containerizing Node.js apps: an updated Docker best-practices guide
The official node image ships a built-in non-root user, but COPY still writes files as root by default — most Node.js Dockerfiles never actually drop privileges.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.