docker
Safeguard articles tagged "docker" — guides, analysis, and best practices for software supply chain and application security.
85 articles
Dockerizing Node.js and PHP Apps: A Practical Guide
Writing a node js dockerfile and learning how to dockerize php application deployments both hinge on the same handful of decisions — base image, layer order, and what you leave out of the final image.
Is node:18-alpine Still Safe to Use in 2025?
The node:18-alpine image is small and popular, but Node.js 18 reached end of life in April 2025. Here is what that means for your containers and how to migrate cleanly.
node:20-alpine: Is the Small Image Worth the Tradeoffs?
node:20-alpine gives you the smallest mainstream Node.js base image, but musl libc and a stripped userland come with real caveats. Here is when to use it and how to harden it.
org.opencontainers.image.source: OCI Labels for Provenance
The org.opencontainers.image.source label ties a container image back to the repository that built it — a small string with outsized value for provenance, registry linking, and supply chain security.
Choosing Secure Node.js Docker Images
How to pick Node.js Docker images that stay small and secure: comparing slim, Alpine, and distroless variants, pinning versions, and scanning for CVEs.
Writing a Secure Kubernetes Dockerfile: A Practical Hardening Guide
The Dockerfile you write decides most of a pod's attack surface before Kubernetes ever schedules it. Here is how to build images that run non-root, stay small, and survive a security review.
Docker Hub Node.js Images: How to Pick and Harden the Right Tag
The official Docker Hub Node.js images come in a dozen variants, and the tag you choose decides your image size, patch cadence, and attack surface. Here is how to read them.
Python Dockerfile Best Practices for Secure, Small Images
The Python Dockerfile best practices that matter most for security are running as a non-root user, choosing a slim base, using multi-stage builds, and pinning dependencies. Here is a working reference Dockerfile and why each line is there.
Python Docker Images: How to Choose a Secure, Slim Base
Choosing among Python Docker images comes down to trade-offs between size, glibc compatibility, and attack surface. Here is how the official tags differ and how to build a lean, low-CVE image.
How .dockerignore Protects Your Builds: A Security Guide
A well-written docker ignore file keeps secrets, git history, and local cruft out of your images — one of the cheapest and most overlooked container security wins.
Docker Privileged Mode: What --privileged Really Grants and Safer Options
Docker Compose privileged mode hands a container nearly all host capabilities. Here is what --privileged actually turns on, and the scoped alternatives that do the same job safely.
Docker Privileged Containers: `docker run` and Compose Risks
docker run privileged and docker compose privileged both hand a container root-equivalent access to the host — here's exactly what that means and when, if ever, it's justified.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.