Containers
Docker LABEL: A Security and Metadata Guide
How the Docker LABEL instruction works, the OCI annotation conventions worth adopting, and how good labels make image supply chains auditable.
Apr 13, 20265 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedContainers
How to Pull and Secure a Node Image from Docker Hub
The official Docker Hub node image ships in several variants that differ wildly in size and CVE count. Here is how to pick one and lock it down.
Apr 9, 20266 min read
Containers
k8s fsGroup: How Kubernetes Sets Volume Ownership Securely
What k8s fsGroup actually does to volume permissions, why it can wreck pod start times, and how to configure it without opening a privilege gap.
Apr 8, 20267 min read
Containers
How to Write a Secure Node.js Dockerfile
A hardened Node.js Dockerfile starts with a pinned base image, a non-root user, and a multi-stage build. Here is how to write one that survives a real security review.
Apr 6, 20266 min read
Containers
Docker Security Issues and How to Fix the Most Common Ones
Most Docker security issues trace back to a handful of predictable mistakes: bloated base images, root containers, and secrets baked into layers. Here is how to find and fix them.
Apr 6, 20266 min read
Containers
cAdvisor: Container Resource Monitoring, Explained
cAdvisor gives you per-container CPU, memory, network, and filesystem metrics out of the box — here's what it actually measures, how it fits with Prometheus and Kubernetes, and where its limits show up.
Apr 5, 20265 min read
Containers
Docker and Container Security Best Practices: A Combined Checklist
A single, practical checklist covering dockers and containers together — image build, runtime config, and CI gates — instead of treating Docker security and container security as separate problems.
Apr 4, 20265 min read
Containers
Node.js in Docker: Choosing and Securing Your Base Image
The Docker Node base image you pick decides your CVE count before you write a line of code. Here is how to choose between Debian, slim, and Alpine — and harden whichever you pick.
Apr 3, 20267 min read
Containers
Node.js Docker Containers: Build Small, Run Safe
A Node.js Docker container that is both small and secure: multi-stage builds, npm ci with a lockfile, non-root users, and why you should not run as PID 1.
Apr 2, 20265 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.