docker
Safeguard articles tagged "docker" — guides, analysis, and best practices for software supply chain and application security.
81 articles
Docker Secrets Management: Stop Baking Credentials Into Images
A secret written into a Docker layer is recoverable forever, even after you delete it. Learn the build-time and runtime patterns that keep credentials out of your images entirely.
Container Security for Beginners: Keeping Your Docker Images Safe
Containers made shipping software wonderfully simple, but they also package up whatever risks come along for the ride. Here is a beginner-friendly introduction with a first image scan you can run today.
Docker Meaning: What Docker Is and Why It Matters for Security
Docker packages an application and everything it needs into a portable container that runs the same everywhere. Understanding that model is the first step to securing it.
Docker Ubuntu Image: How to Use It Securely and Keep It Slim
The Docker Ubuntu image is a fine base, but a naive Dockerfile ships a bloated, vulnerable container. Here is how to pin, slim, and scan it properly.
Docker Image Security Best Practices
Every Docker layer you ship is attack surface you have to defend. Learn how to build lean, non-root, secret-free images that survive a registry scan and a real audit.
Running Node.js on Ubuntu in Docker, Securely
A guide to the Node Ubuntu Docker pattern: when an Ubuntu base makes sense for Node.js, how to build it safely, and the security trade-offs versus slim images.
Docker Architecture Explained: A Security-Focused Breakdown
Docker architecture is a client-server system built on the daemon, containerd, images, and the kernel features that isolate containers. Here is how the pieces fit and where the security lines are.
Scanning Docker Images for Vulnerabilities: How To
Knowing how to scan Docker images for vulnerabilities before they ship is the difference between catching a known CVE in CI and finding it in an incident report.
Choosing a Container Security Scanner
A practical checklist for choosing a container security scanner, covering base-image coverage, registry integration, runtime relevance, and how scan noise actually gets managed.
How Snyk Container handles multi-stage Docker builds duri...
How Snyk Container identifies base images, attributes vulnerabilities to Dockerfile instructions, and scopes scans across multi-stage Docker builds.
CVE-2025-9074 in Docker Desktop: Patch Posture & SBOM Response
Docker Desktop container-to-host escape scored CVSS 9.3. Affected Windows and macOS developer fleets need a fast patch rollout. Defender playbook below.
Container Base Image Hygiene: An Underrated Lever for Red...
Swapping bloated base images for minimal ones can cut container CVE counts by 60-90% without touching app code. Here's the data and how to start.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.