Should each service have its own database instance or share one?
I'm new to Docker and using it to learn and experiment. I currently have two services sharing a PostgreSQL container, with an initial migration that creates a separate…
container security
How can I generate one complete SBOM for a Python container release?
Our services run as Python applications inside containers. We currently generate one SBOM from the container image and another from the dependency lockfile, but they never match because…
What level of isolation are you using for AI agents in Kubernetes?
For teams running AI agents in production on Kubernetes, what security boundary do you put between agents and between an agent and the host? Regular pods provide namespaces,…
What’s the best way to continuously scan running container images for vulnerabilities?
I'm looking for a practical way to monitor container images after they're deployed, rather than relying only on scans during build time. Is Trivy Operator still the simplest…
What’s the Best Way to Continuously Scan Running Container Images?
I'm looking for a practical way to continuously monitor container images that are already running for known vulnerabilities. Is Trivy Operator still the simplest option for quickly scanning…
What’s the best way to self-host a private container registry for Windows customers?
My company maintains five applications for many customers, and deployments are currently handled by copying build files to each customer's Windows server over Remote Desktop. I'd like to…
How do you detect malware in container images and at runtime?
I'm not asking about conventional vulnerability scanning. Traditional endpoint security tools may not inspect files inside containers because the container filesystem is isolated from the host. Do you…
How do you scan container images and detect malware at runtime?
Traditional endpoint security tools may not inspect files inside containers because the container filesystem is isolated from the host. I'm not asking about vulnerability scanning—I'm specifically interested in…
How do you prioritize hundreds of container CVEs so the real risks get fixed first?
Our container images are scanned on every build, and the results often contain hundreds of high and critical findings, many of them inherited from base-image packages. In the…
How do you prioritize the hundreds of CVEs found in container images?
I maintain the container images for our services, and vulnerability scanning produces hundreds of high and critical findings every week. Most are inherited from base-image packages, and many…
Docker Compose bind mounts fail with permission errors on openSUSE
I recently moved from Fedora to openSUSE and tried to build a project that worked previously. Containers started with docker run can access their files, but the same…
How do you secure and manage third-party Helm charts and container images?
For cluster infrastructure such as External Secrets Operator, Argo CD, and similar tools, what is a practical way to scan, harden, and manage the Helm charts and container…
Is it insecure to run an internet-facing web Pod on the same node as the database?
Suppose an entire application stack runs on Kubernetes, with the database in one Pod and the web server in another Pod scheduled on the same node. The web…
Can a Docker Hub image be malicious, and how can I check or remove it safely?
I pulled an image from Docker Hub and now I'm worried it might contain malware, such as code that could collect credentials or access files it shouldn't. I…
How Can I Tell Whether a Docker Image Is Malicious?
I pulled an image from a public container registry and started worrying that it might contain malware, such as code that could collect credentials or access files it…
How Should We Handle Vulnerabilities Discovered After an Image Ships?
We scan container images in CI and block releases when critical vulnerabilities are found. An image passed the scan and was deployed, but about three weeks later the…
How should we handle vulnerabilities discovered after an unchanged container image ships?
We scan container images in CI and block releases when critical vulnerabilities are found. An image passed the scan and was deployed, but about three weeks later the…
Are Clean, Minimal, and Hardened Container Images Actually Different?
I'm learning more about container security and keep seeing terms like clean, minimal, hardened, and near-zero-CVE images. They seem related, but I'm not sure where the distinctions are.…
Why Do Docker Sandboxes Allow Passwordless sudo by Default?
I'm trying to run several isolated coding agents with strong restrictions: they shouldn't be able to communicate with one another, and some shouldn't have web access at all.…
How can we stop a suspicious dependency before it executes during an image build?
We had a near miss where an automated assistant suggested a dependency whose name differed from a legitimate package by only one character. It had a single maintainer,…