Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Keeping up with Kubernetes security news today means more than reading headlines. Here's how to triage a fresh CVE, what IngressNightmare taught us, and where to look first.
Image scanners are excellent at matching OS packages and language dependencies against CVE databases — and structurally blind to config flaws, runtime behavior, and code you compiled yourself. Where the line sits.
You do not build Docker images inside Kubernetes the old way anymore. Here are the secure patterns for building images that k8s will run, from CI to in-cluster builders.
A Docker scratch image starts from nothing, and that emptiness is the point: no shell, no package manager, and almost no CVEs for a scanner to find.
Docker security scanning inspects your container images for known-vulnerable OS and application packages before they reach production. Here is how it works and how to wire it into your pipeline.
A practical setup guide for running node.js docker containers in production, choosing between docker node slim and full images, and locking down what actually matters for security.
The core Kubernetes network policy best practice is to default-deny all traffic and then explicitly allow only what each workload needs. Here is how to build that model without breaking your cluster.
A k8s admission controller intercepts every request to the API server and can validate or mutate it, making it the natural enforcement point for security policy.
How to build Golang Docker images that stay small, patch cleanly, and don't ship a compiler toolchain into production, using multi-stage builds done properly.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
