containers
Safeguard articles tagged "containers" — guides, analysis, and best practices for software supply chain and application security.
89 articles
Rolling Out Zero-CVE Base Images Org-Wide
A pragmatic playbook for migrating an entire engineering organisation onto zero-CVE base images, covering pilot selection, registry mirroring, drift control, and the hard people-side of the rollout.
How to Pull and Secure a Node Image from Docker Hub
The official Docker Hub node image ships in several variants that differ wildly in size and CVE count. Here is how to pick one and lock it down.
Container Supply Chain Defence: Build To Run
An end-to-end view of container supply chain controls from source through registry to runtime, covering signing, attestation, admission policy, and runtime drift, with concrete checkpoints at each stage.
How to Write a Secure Node.js Dockerfile
A hardened Node.js Dockerfile starts with a pinned base image, a non-root user, and a multi-stage build. Here is how to write one that survives a real security review.
Docker Security Issues and How to Fix the Most Common Ones
Most Docker security issues trace back to a handful of predictable mistakes: bloated base images, root containers, and secrets baked into layers. Here is how to find and fix them.
Docker and Container Security Best Practices: A Combined Checklist
A single, practical checklist covering dockers and containers together — image build, runtime config, and CI gates — instead of treating Docker security and container security as separate problems.
Kubernetes Admission Policy Real-World Deployment
What it actually takes to put Kubernetes admission policy into enforcement mode without breaking deployments: phased rollout, exception workflows, audit-mode hygiene, and policy authoring conventions that survive contact with engineers.
Node.js Docker Containers: Build Small, Run Safe
A Node.js Docker container that is both small and secure: multi-stage builds, npm ci with a lockfile, non-root users, and why you should not run as PID 1.
Container Registry Security Hardening Checklist for 2026
A concrete hardening checklist for container registries in 2026, covering authentication, signing, scanning, retention, and the operational details that actually matter.
Docker BuildKit Security Best Practices for 2026
BuildKit has been the default Docker builder for years, but its security features remain underused. Here are the practices that matter in 2026.
Docker Image File Extensions: What a .tar Image Actually Contains
Docker images do not have a special file extension. When you save one it is a .tar archive. Here is what is inside, and how the OCI layout is structured.
Pod Supply Chain Attestation Validation
How to validate supply chain attestations at pod admission time without grinding deployments to a halt: which attestation types actually matter, how to chain verifications, and how to fail useful.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.