docker-security
Safeguard articles tagged "docker-security" — guides, analysis, and best practices for software supply chain and application security.
42 articles
How to Containerize a Node.js App Securely
The default Node.js Dockerfile runs as root, ships dev dependencies, and bakes secrets into layers. Here is a secure, multi-stage build you can copy, step by step.
10 Docker image security best practices
Ten concrete Docker image security practices — minimal base images, secret handling, reachability-based scanning, non-root runtimes, and SBOMs — with real CVEs and data.
Detecting vulnerabilities in multi-stage Docker builds
Multi-stage Docker builds hide vulnerabilities, leaked secrets, and untracked dependencies in discarded layers. Here's what final-image scans miss and how to catch it.
Keeping Docker secrets secure without Kubernetes
Docker ships with tmpfs-backed Swarm secrets, BuildKit secret mounts, and Compose file secrets — here's how to use them without Kubernetes.
Detecting cryptomining malware in container images
Cryptomining malware like Kinsing and TeamTNT quietly hijacks container CPU cycles to mine Monero. Here's how it gets in, how to spot it, and how to stop it.
Container security for Kubernetes and Docker
A practical glossary breakdown of container security for Kubernetes and Docker: the real risks, key benchmarks, and where code-scanning tools like Checkmarx fall short.
Docker Privileged Mode: What It Unlocks and Why to Avoid It
One flag, --privileged, hands a container almost the same power as root on the host. Here is exactly what it turns on, why it breaks isolation, and the narrow capabilities that replace it.
How Snyk Container detects a Dockerfile's base image with...
Snyk Container identifies a Dockerfile's true base image by comparing layer digests against a registry database, no docker run required.
How Snyk's Docker Desktop Extension scans images before t...
How Snyk's Docker Desktop extension scans local images for CVEs before push, what it can and can't detect, and where it fits with CI and registry scanning.
Docker Image for Node: Choosing Slim vs Full Builds
The default node image on Docker Hub ships a full Debian userland most services never touch — knowing when slim, alpine, or distroless actually pays off keeps builds smaller without breaking native modules.
How to List Images in a Docker Registry (and Why the CLI Cannot)
To list images in a Docker registry you query the Registry HTTP API v2 directly, because the docker CLI has no command to enumerate a remote registry. Here is how to do it, and how to lock the endpoint down.
Why Container Registries Are an Underexamined Supply Chai...
Registries decide what code actually runs in production, yet most security programs treat them as passive storage. Here's why that's a costly blind spot.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.