Case Studies
A Healthcare System's Self-Healing Container Rollout
An anonymized account of how a regional North American healthcare system deployed Safeguard's self-healing container base images across 600+ workloads.
Jan 22, 20267 min read
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
An anonymized account of how a regional North American healthcare system deployed Safeguard's self-healing container base images across 600+ workloads.
Writing cosign verification policies that actually pass production deployment gates requires more precision than the examples suggest. Here is what we have learned.
Multi-stage builds reduce image size, but they also introduce security considerations around build secrets, layer caching, and dependency leakage.
Compare Trivy and Grype on vulnerability database sources, scan speed, OS coverage, SBOM integration, and CI ergonomics to pick the right open source container scanner.
Your base image choice determines your container security baseline. Most teams pick based on size or familiarity, not security properties.
Not all container scanners are equal. We compared Trivy, Grype, Snyk Container, and others on accuracy, speed, and coverage.
Misconfigured Kubernetes RBAC is a common path to supply chain compromise. Here's how to lock down permissions in your clusters.
Alpine Linux is the default choice for minimal containers. Its APK package manager has a different security model than apt or dnf, and the tradeoffs matter.
Static scanning finds known vulnerabilities. Runtime analysis finds actual exploitation. Using only one gives you half the picture.
Weekly insights on software supply chain security, delivered to your inbox.