Containers
Kubernetes runAsUser: How to Run Containers as a Non-Root User
What the Kubernetes runAsUser security context does, how to set it correctly, and the common mistakes that quietly leave pods running as root.
Jun 11, 20255 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedContainers
Docker Hub Node Images: Choosing and Securing the Right Node Tag
The official Node image on Docker Hub ships in half a dozen flavors, and the tag you pick changes your attack surface far more than most teams realize.
Jun 11, 20256 min read
Containers
Kubernetes SecurityContext, Field by Field
SecurityContext in Kubernetes is where pod and container hardening actually lives — here's what each field controls and which defaults you should never leave in place.
Jun 11, 20255 min read
Containers
Docker Container Security: A Hardening Checklist
Most container breaches trace back to a handful of avoidable mistakes — root users, bloated images, exposed sockets, unscanned dependencies. This checklist closes them, image to runtime.
Jun 10, 20257 min read
Containers
PHP Docker: How to Build a Secure PHP Docker Image
A secure PHP Docker setup starts with a supported base tag, a slim image, a non-root user, and a scanned dependency tree. Here is how to get all four.
Jun 9, 20255 min read
Containers
Docker Node Alpine: When to Use the Slim Image
Node Alpine Docker images cut attack surface and pull times dramatically, but musl libc compatibility gaps mean they're not a drop-in replacement for every Node project.
Jun 5, 20256 min read
Containers
Docker Compose: Rebuilding Images Correctly (and Catching Stale Layers)
Why docker compose up sometimes runs old code, and how to rebuild images so what runs matches what you edited, including cache, stale layers, and orphaned images.
Jun 4, 20256 min read
Containers
Docker Hub Node.js Images: How to Pick and Harden the Right Tag
The official Docker Hub Node.js images come in a dozen variants, and the tag you choose decides your image size, patch cadence, and attack surface. Here is how to read them.
May 27, 20255 min read
Containers
Kubernetes CVE News: How to Track and Respond to Cluster Vulnerabilities
Where Kubernetes CVE news actually breaks, how to read a cluster advisory, and a repeatable process for triaging vulnerabilities before they turn into an incident.
May 27, 20256 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.