docker
Safeguard articles tagged "docker" — guides, analysis, and best practices for software supply chain and application security.
81 articles
Dev Containers Security Baseline for 2026
A practical security baseline for devcontainer.json files in 2026, covering base image selection, features, lifecycle scripts, and the supply chain controls that actually matter.
How a Container Image Scanner Works (and Which One to Use)
A container image scanner inspects the layers, packages, and configuration inside an image to find known vulnerabilities before you ship it. Here is how the scan works and what separates a good tool from a noisy one.
How to Scan Docker Images for Vulnerabilities
A production-grade vulnerability scanning pipeline for Docker images using Trivy and Grype, with reachability-based prioritization and admission enforcement.
Container Security Best Practices for 2025: Beyond Image Scanning
Container security has evolved far past vulnerability scanning. Here is what mature container security programs look like heading into 2025.
Alpine vs Distroless vs Ubuntu Base Images: Security Tradeoffs
Alpine is small, distroless is smaller, Ubuntu is comfortable. The real security question is CVE surface vs debuggability vs compatibility — with numbers.
How to Secure Container Software: A Practical Guide
Securing container software means controlling the whole chain, base image, dependencies, build, registry, and runtime, not just scanning the final image. Here is a working model for each layer.
AI-Generated Dockerfile Vulnerability Patterns
LLM-generated Dockerfiles repeat the same six or seven mistakes. Here is the pattern catalog and how to catch them before they ship.
How to configure OWASP ZAP for automated scanning
A step-by-step guide to configuring OWASP ZAP for automated scanning in CI/CD, from Docker setup through baseline and API scans to pipeline gating.
Container Security Vulnerabilities: How to Find and Fix Them
The container security vulnerabilities that actually get exploited, where they hide across the image lifecycle, and a practical order for fixing them without rebuilding everything at once.
Running Containers in Rootless Mode: A Practical Security Guide
Root in the container often means root on the host. Rootless mode breaks that assumption. Here is how to run Docker and Podman without root and why it matters more than you think.
Container Security Best Practices Checklist 2026
A practical container security checklist for 2026 covering base images, runtime controls, registry hygiene, and signing, with specific thresholds defenders can adopt.
Container Image Hardening Checklist
A comprehensive checklist for hardening your container images, from base image selection to runtime protections, with practical Dockerfile examples.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.