docker
Safeguard articles tagged "docker" — guides, analysis, and best practices for software supply chain and application security.
85 articles
Docker Ubuntu Image: How to Use It Securely and Keep It Slim
The Docker Ubuntu image is a fine base, but a naive Dockerfile ships a bloated, vulnerable container. Here is how to pin, slim, and scan it properly.
Docker Image Security Best Practices
Every Docker layer you ship is attack surface you have to defend. Learn how to build lean, non-root, secret-free images that survive a registry scan and a real audit.
Running Node.js on Ubuntu in Docker, Securely
A guide to the Node Ubuntu Docker pattern: when an Ubuntu base makes sense for Node.js, how to build it safely, and the security trade-offs versus slim images.
Container SBOM Generation: Best Practices for 2025
Container images are multi-layered artifacts that challenge SBOM generators. Here is how to generate comprehensive, accurate SBOMs for containerized applications.
Docker Architecture Explained: A Security-Focused Breakdown
Docker architecture is a client-server system built on the daemon, containerd, images, and the kernel features that isolate containers. Here is how the pieces fit and where the security lines are.
Scanning Docker Images for Vulnerabilities: How To
Knowing how to scan Docker images for vulnerabilities before they ship is the difference between catching a known CVE in CI and finding it in an incident report.
Choosing a Container Security Scanner
A practical checklist for choosing a container security scanner, covering base-image coverage, registry integration, runtime relevance, and how scan noise actually gets managed.
How Snyk Container handles multi-stage Docker builds duri...
How Snyk Container identifies base images, attributes vulnerabilities to Dockerfile instructions, and scopes scans across multi-stage Docker builds.
CVE-2025-9074 in Docker Desktop: Patch Posture & SBOM Response
Docker Desktop container-to-host escape scored CVSS 9.3. Affected Windows and macOS developer fleets need a fast patch rollout. Defender playbook below.
Container Base Image Hygiene: An Underrated Lever for Red...
Swapping bloated base images for minimal ones can cut container CVE counts by 60-90% without touching app code. Here's the data and how to start.
Go and Docker: Building Secure Container Images
Go and Docker pair well because Go compiles to a static binary that fits in a tiny, near-empty image. This guide shows how to build that image securely.
Writing a Secure Node.js Dockerfile: Best Practices That Hold Up
A secure Node.js Dockerfile pins a specific base image, runs as a non-root user, and uses multi-stage builds to keep build tooling out of production. Here is a hardened template and why each line matters.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.