Containers
Docker Images Format Explained: Layers, OCI, and Security
Understanding the Docker images format, from layers and manifests to the OCI spec, is the foundation for scanning, signing, and hardening what you ship.
Apr 22, 20256 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedContainers
Choosing a Docker Security Tool: What Actually Matters
A Docker security tool scans images, configs, and running containers for risk. Here is what each category covers and how to pick one that fits your workflow.
Apr 22, 20256 min read
Containers
Dockerfile Best Practices: Security, Size, and Build Speed
Most Dockerfiles are copy-pasted from a tutorial and never revisited. Here's what actually shrinks image size, closes the common security holes, and speeds up rebuilds.
Apr 14, 20255 min read
Containers
Docker Laravel Security: Hardening Your PHP Container from Base Image to Runtime
A security-focused guide to running Laravel in Docker — non-root PHP-FPM, multi-stage builds, secret handling, and locking down the layers that leak.
Apr 11, 20256 min read
Containers
Docker LABEL: A Security and Metadata Guide
How the Docker LABEL instruction works, the OCI annotation conventions worth adopting, and how good labels make image supply chains auditable.
Apr 8, 20255 min read
Containers
How to Pull and Secure a Node Image from Docker Hub
The official Docker Hub node image ships in several variants that differ wildly in size and CVE count. Here is how to pick one and lock it down.
Mar 18, 20256 min read
Containers
k8s fsGroup: How Kubernetes Sets Volume Ownership Securely
What k8s fsGroup actually does to volume permissions, why it can wreck pod start times, and how to configure it without opening a privilege gap.
Mar 18, 20257 min read
Containers
Docker Security Issues and How to Fix the Most Common Ones
Most Docker security issues trace back to a handful of predictable mistakes: bloated base images, root containers, and secrets baked into layers. Here is how to find and fix them.
Mar 18, 20256 min read
Containers
How to Write a Secure Node.js Dockerfile
A hardened Node.js Dockerfile starts with a pinned base image, a non-root user, and a multi-stage build. Here is how to write one that survives a real security review.
Mar 18, 20256 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.