# container-security Published articles for container-security. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## A Bootiful Podcast: BellSoft's Catherine Edelveis on hardened runtime images, container security, and more DevFeed: [A Bootiful Podcast: BellSoft's Catherine Edelveis on hardened runtime images, container security, and more]() Original publisher: [Read original article]() Author: joshlong Published: 2026-09-03T00:00:00Z Content type: article Language: en Sources: [Spring]() Topics: [container-security]() Tags: [batch](), [boot](), [cloud](), [container-security](), [event-driven](), [java](), [microservices](), [podcast](), [reactive](), [security](), [serverless](), [spring](), [spring-boot](), [web-applications]() ### AI overview A podcast conversation about using buildpacks and hardened images to ship Spring Boot applications with stronger security, cleaner defaults, and less Dockerfile work. ### Source excerpt Hi, Spring fans! I chat with BellSoft's Catherine Edelweiss about using buildpacks and hardened images to ship Spring Boot apps with stronger security, cleaner defaults, and far less Dockerfile pain. #BellSoft #Docker #Java #JRE #SpringBoot ## Forensic container checkpointing on Amazon Elastic Kubernetes Service (Amazon EKS) DevFeed: [Forensic container checkpointing on Amazon Elastic Kubernetes Service (Amazon EKS)]() Original publisher: [Read original article]() Author: Varun DeviReddy Published: 2026-08-12T17:38:15Z Content type: tutorial Language: en Sources: [Containers]() Topics: [incident]() Tags: [advanced-300](), [amazon-eks](), [amazon-elastic-kubernetes-service](), [api](), [container-security](), [containers](), [incident-response](), [kubernetes](), [memory](), [processes](), [security](), [technical-how-to]() ### AI overview This tutorial explains how to preserve volatile runtime evidence from suspicious containers on Amazon EKS by using the Kubelet Checkpoint API. It deploys a checkpoint agent that captures container state without stopping the workload, packages the result as an OCI image, and stores it in Amazon ECR for later forensic analysis. ### Source excerpt Amazon EKS 1.34 makes the Kubelet Checkpoint API functional, so you can capture a running container's full state (memory, processes, and network connections) without stopping the workload. This post shows how to deploy an unprivileged checkpoint agent that stores forensic checkpoints in Amazon ECR as OCI images for later analysis. ## Node-gyp Supply Chain Compromise: A Self-Propagating npm Worm That Hides in binding.gyp DevFeed: [Node-gyp Supply Chain Compromise: A Self-Propagating npm Worm That Hides in binding.gyp]() Original publisher: [Read original article]() Author: Liran Tal Published: 2026-06-04T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [npm](), [Malware](), [Security](), [GitHub Actions](), [GitHub](), [Maintainers]() Tags: [awareness](), [blog](), [ci-cd](), [container-security](), [developer](), [devops](), [devsecops](), [eslint](), [github](), [github-actions](), [javascript](), [maintainers](), [malware](), [node](), [node-js](), [open-source-security](), [payload](), [persistence](), [scm](), [secrets](), [security](), [snyk-open-source](), [supply-chain](), [supply-chain-security](), [tech](), [vulnerability-insights]() ### AI overview Snyk reports a critical npm supply-chain compromise in which a weaponized binding.gyp file abuses node-gyp during installation to execute malicious code without relying on lifecycle scripts. The worm affects 57 packages, harvests developer and CI/CD credentials, exfiltrates them through GitHub repositories, injects GitHub Actions workflows for persistence, and republishes packages accessible through compromised maintainer accounts. ### Source excerpt A new npm worm is abusing binding.gyp to trigger node-gyp during install, letting malicious packages run code without lifecycle scripts. It steals credentials, persists in GitHub, and self-propagates across maintainers. ## Secure What Matters: Scaling Effortless Container Security for the AI Era DevFeed: [Secure What Matters: Scaling Effortless Container Security for the AI Era]() Original publisher: [Read original article]() Author: Pratip Banerji; Brendan Hann Published: 2026-04-07T04:00:00Z Content type: release Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [container-security](), [snyk-container](), [Containers](), [vulnerability](), [Deployment](), [CI/CD](), [Command-line interface](), [Artificial Intelligence]() Tags: [ai](), [americas](), [awareness](), [blog](), [ci-cd](), [cli](), [container-security](), [containers](), [deployment](), [developer](), [devops](), [devsecops](), [docker](), [engineering](), [go](), [interest](), [security](), [snyk-container](), [snyk-platform](), [tech](), [vulnerability](), [vulnerability-insights]() ### AI overview Snyk announces the general availability of Container Registry Sync, which automates the discovery, scanning, and pruning of container images. The article also previews a unified product experience for managing container-image risk across CLI, CI/CD, and registries. ### Source excerpt Announcing Snyk Container Registry Sync GA for automated image management and runtime intelligence. Scale container security effortlessly for the fast-paced AI era. ## How a Poisoned Security Scanner Became the Key to Backdooring LiteLLM DevFeed: [How a Poisoned Security Scanner Became the Key to Backdooring LiteLLM]() Original publisher: [Read original article]() Author: Stephen Thoemmes Published: 2026-03-24T04:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [open-source-security](), [CI/CD](), [incident](), [Processes](), [cursor]() Tags: [ai](), [application-security](), [aspm](), [awareness](), [blog](), [ci-cd](), [cloud-security](), [code-security](), [container-security](), [developer](), [devops](), [devsecops](), [docker](), [github-actions](), [incident](), [kubernetes](), [malware](), [open-source-security](), [python](), [secrets](), [security](), [supply-chain](), [supply-chain-security](), [teampcp](), [vulnerability-insights]() ### AI overview Snyk reports that compromised Trivy GitHub Action credentials enabled TeamPCP to publish malicious LiteLLM package versions 1.82.7 and 1.82.8 to PyPI. The payload ran at Python startup and recursively spawned subprocesses, causing unintended RAM exhaustion and a fork bomb. ### Source excerpt On March 24, 2026, threat actor known as TeamPCP published backdoored versions of the litellm Python package after stealing PyPI credentials via a compromised Trivy GitHub Action in LiteLLM's CI/CD pipeline. Here's what happened, how the three-stage malware works, and how to check if you're affected. ## Forrester TEI study: Chainguard Containers delivered 233% return on investment DevFeed: [Forrester TEI study: Chainguard Containers delivered 233% return on investment]() Original publisher: [Read original article]() Published: 2026-02-18T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard containers](), [container-security](), [chainguard](), [vulnerability management](), [Containers](), [Vulnerabilities](), [Application Security](), [Open Source]() Tags: [chainguard](), [chainguard-containers](), [chainguard-forrester](), [chainguard-roi](), [chainguard-value](), [cmmc](), [compliance](), [container-security](), [containers](), [forrester-tei](), [open-source](), [pci-dss](), [security](), [vulnerabilities](), [vulnerability-management]() ### AI overview A Forrester Consulting Total Economic Impact study commissioned by Chainguard reports that customers using Chainguard Containers achieved a 233% return on investment over three years, with $2.5 million in benefits and payback in less than six months. The article attributes these results to reduced vulnerabilities, simpler maintenance, and lower compliance overhead, supported by minimal zero-CVE container images and automated remediation. ### Source excerpt Explore the latest Forrester Consulting Total Economic Impact™ (TEI) study, commissioned by Chainguard. ## The only rule: Don't look at the code DevFeed: [The only rule: Don't look at the code]() Original publisher: [Read original article]() Published: 2025-12-29T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Vibe coding](), [AI Development](), [container-security](), [supply-chain-security]() Tags: [ai](), [ai-assisted-coding](), [ai-engineering](), [chainguard-ai](), [chainguard-vibelympics](), [code-quality](), [container-security](), [software-supply-chain](), [vibe-coding]() ### AI overview Chainguard's Vibelympics was a vibe-coding tournament in which 59 individuals and teams built software without looking at the generated code. The article describes the competition's challenges, including an emoji-only interface and a package ecosystem security auditor, and highlights selected submissions and results. ### Source excerpt Chainguard's Vibelympics competition brought out the best and most creative ideas in vibe coding and AI-assisted software development. ## How Snyk Helps Federal Agencies Prepare for the Genesis Mission Era of AI-Driven Science DevFeed: [How Snyk Helps Federal Agencies Prepare for the Genesis Mission Era of AI-Driven Science]() Original publisher: [Read original article]() Author: Phoebe Nerdahl Published: 2025-12-09T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [iac-security](), [CI/CD]() Tags: [ai](), [awareness](), [blog](), [ci-cd](), [cloud](), [container-security](), [containers](), [cybersecurity](), [data](), [datasets](), [developers](), [executive](), [government](), [iac-security](), [infrastructure-as-code](), [open-source](), [open-source-security](), [research](), [science](), [security](), [snyk-container](), [snyk-iac](), [snyk-open-source](), [software](), [supply-chain]() ### AI overview Snyk explains how federal agencies can secure AI-driven scientific software, data pipelines, cloud resources, and software supply chains for the Genesis Mission. ### Source excerpt Snyk helps Federal Agencies secure software for the White House's Genesis Mission, accelerating AI-driven science. Implement Secure by Design for the supply chain, cloud, and pipelines. ## Security Advisory: Critical RCE Vulnerabilities in React Server Components (CVE-2025-55182) DevFeed: [Security Advisory: Critical RCE Vulnerabilities in React Server Components (CVE-2025-55182)]() Original publisher: [Read original article]() Author: Stephen Thoemmes Published: 2025-12-03T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [React](), [Vulnerabilities](), [Next.js](), [Exploit](), [Security](), [Flight](), [HTTP]() Tags: [awareness](), [blog](), [cloud-security](), [code-security](), [container-security](), [cve](), [developer](), [devrel](), [docker](), [engineering](), [http](), [incident](), [next-js](), [react](), [remote](), [remote-code-execution](), [security](), [upgrade](), [vulnerabilities](), [vulnerability-insights]() ### AI overview The article reports critical unauthenticated remote code execution vulnerabilities in React Server Components and Next.js caused by unsafe deserialization of attacker-controlled data in the RSC "Flight" protocol. It explains that default configurations were exploitable, identifies affected React and Next.js releases and other tools embedding RSC, and urges immediate patching. ### Source excerpt Critical RCE vulnerabilities (CVE-2025-55182/CVE-2025-66478) were found in React Server Components and Next.js via unsafe deserialization. Immediate upgrade to patched versions is mandatory to prevent unauthenticated remote code execution. Learn how to detect and mitigate the critical flaw. ## Snyk and Continue Partner to Embed AI-Powered Security into Every Step of the Developer Workflow DevFeed: [Snyk and Continue Partner to Embed AI-Powered Security into Every Step of the Developer Workflow]() Original publisher: [Read original article]() Author: Sarah Conway Published: 2025-11-18T05:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [AI Development](), [Security](), [code productivity](), [sdlc](), [Code](), [Infrastructure as code](), [Containers](), [developer tooling](), [ide](), [Command-line interface]() Tags: [agents](), [ai](), [awareness](), [blog](), [cli](), [code](), [code-security](), [container-security](), [containers](), [dependencies](), [developer](), [development-tools](), [devsecops](), [executive](), [extension](), [iac](), [open-source-security](), [related-content](), [sdlc](), [security](), [snyk-platform](), [workflow]() ### AI overview Snyk and Continue announce a partnership integrating AI-powered security into the software development lifecycle. The integration lets developers scan code, dependencies, infrastructure as code, and containers through natural-language commands, while receiving context-aware fix suggestions through Continue's agents, IDE extension, or CLI. ### Source excerpt Snyk is excited to announce a new partnership with Continue, which will embed AI-powered security into every step of the SDLC. This partnership allows developers to scan code, dependencies, and IaC using natural language commands and get context-aware fix suggestions instantly, whether leveraging Agents in Continue Mission Control, an IDE extension, or a CLI. ## Automated Package-Publication Incident IndonesianFoods in the NPM Ecosystem Linked to Crypto Reward-Farming Scam DevFeed: [Automated Package-Publication Incident IndonesianFoods in the NPM Ecosystem Linked to Crypto Reward-Farming Scam]() Original publisher: [Read original article]() Author: Stephen Thoemmes Published: 2025-11-13T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [incident](), [Boilerplate]() Tags: [automation](), [awareness](), [blog](), [code-security](), [container-security](), [cryptocurrency](), [developer](), [ecosystem](), [incident](), [next-js](), [npm-packages](), [open-source-security](), [publication](), [scam](), [security](), [snyk-code](), [snyk-container](), [snyk-iac](), [snyk-open-source](), [supply-chain-security]() ### AI overview The article examines a large-scale surge of similarly structured NPM package publications linked to a dormant automation script associated with a cryptocurrency reward-farming scheme. It reports no verified active exploit and says the packages currently pose minimal risk, while emphasizing dependency hygiene and registry safeguards. ### Source excerpt In November 2025, a large-scale surge of package publications on the NPM registry with similar structures and naming patterns was discovered. Understand the details of the incident. ## Beyond the Scan: The Future of Snyk Container DevFeed: [Beyond the Scan: The Future of Snyk Container]() Original publisher: [Read original article]() Author: Brendan Hann; Pratip Banerji Published: 2025-11-04T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [container-security](), [Vulnerabilities](), [CI/CD]() Tags: [ai](), [awareness](), [blog](), [ci-cd](), [container-security](), [developer](), [docker](), [docker-hub](), [engineering](), [monitoring](), [pmm](), [security](), [snyk-container](), [vulnerabilities]() ### AI overview Snyk outlines a developer-first vision for container security that connects the IDE, CI/CD pipeline, container registry, and production. It highlights continuous registry monitoring to identify newly disclosed vulnerabilities in previously built images. ### Source excerpt Snyk Container rethinks security, moving beyond scans to deliver a comprehensive, end-to-end solution. It connects the entire lifecycle, from IDE to production, with continuous monitoring and AI-powered remediation. ## Agentic Container Security with Snyk MCP Server DevFeed: [Agentic Container Security with Snyk MCP Server]() Original publisher: [Read original article]() Author: Liran Tal Published: 2025-08-13T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [container-security](), [vulnerability](), [Application Security](), [Kubernetes](), [ci]() Tags: [agentic](), [ai](), [application-security](), [blog](), [container-security](), [containers](), [developer](), [devops](), [devrel](), [ide](), [interest](), [kubernetes](), [mcp](), [mcp-server](), [security](), [snyk-platform](), [vulnerability]() ### AI overview The article discusses using Snyk's MCP server in AI-powered IDE workflows to scan container vulnerabilities and recommend base-image changes earlier in development. ### Source excerpt Learn how Snyk's MCP server brings agentic security to container workflows. Automate vulnerability scanning and base image recommendations directly within your AI-powered IDE. ## Chainguard Now Available on Microsoft Azure Marketplace; Scan Chainguard Container Images with Microsoft Defender for Cloud DevFeed: [Chainguard Now Available on Microsoft Azure Marketplace; Scan Chainguard Container Images with Microsoft Defender for Cloud]() Original publisher: [Read original article]() Published: 2025-07-16T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard containers](), [Azure](), [container images](), [container-security](), [vulnerability scanning](), [Microsoft]() Tags: [azure](), [azure-marketplace](), [chainguard](), [chainguard-containers](), [chainguard-images](), [ci-cd](), [container-images](), [container-security](), [defender](), [microsoft-defender](), [security](), [vulnerability-scanning]() ### AI overview Chainguard Containers is now available through the Microsoft Azure Marketplace, enabling Azure customers to adopt it within existing procurement, billing, deployment, and CI/CD workflows. Microsoft Defender for Cloud can also scan Chainguard container images for vulnerabilities, improving visibility and security across container environments. ### Source excerpt Chainguard is now listed on the Microsoft Azure Marketplace. In addition, Microsoft Defender for Cloud can now scan Chainguard container images. ## Fork yeah: We're bringing kaniko back DevFeed: [Fork yeah: We're bringing kaniko back]() Original publisher: [Read original article]() Published: 2025-06-05T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [Open Source](), [supply-chain-security](), [container-security](), [Docker](), [Kubernetes]() Tags: [chainguard](), [container](), [container-security](), [deprecated](), [docker](), [docker-images](), [fork](), [google](), [kaniko](), [kubernetes](), [maintenance](), [open-source](), [safe-source-for-open-source](), [software-supply-chain]() ### AI overview Chainguard is forking and taking over maintenance of Kaniko after Google announced plans to archive it. The project will remain open and upstream, with a focus on maintenance and minor bug fixes rather than new features, while Chainguard also offers commercial Kaniko images for organizations needing zero-CVE or FIPS versions. ### Source excerpt Chainguard is taking over the maintenance of the Kaniko project, recently deprecated by Google. Learn more about why we're doing it and what is next. ## Microauthorization: Why Microservices can be Great for Security Hygiene DevFeed: [Microauthorization: Why Microservices can be Great for Security Hygiene]() Original publisher: [Read original article]() Published: 2025-05-08T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [Architecture & Design](), [microservices architecture](), [Security](), [Authorization](), [IAM]() Tags: [architecture](), [authorization](), [container-security](), [iam](), [least-privilege](), [microauthorization](), [microservices](), [remote-code-execution](), [security]() ### AI overview The article argues that decomposing monolithic applications into microservices can improve security hygiene by isolating processes and assigning each service a distinct identity with narrower IAM capabilities. It explains that service-to-service authorization can limit the blast radius of a breach, although attackers may still need to move laterally across services. ### Source excerpt Microservices can enable you to easily independently roll out services, but they can also provide security benefits. Learn more with Chainguard CTO Matt Moore. ## Announcing Chainguard's Series D: Building the Safe Source for All Open Source DevFeed: [Announcing Chainguard's Series D: Building the Safe Source for All Open Source]() Original publisher: [Read original article]() Published: 2025-04-23T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [open-source-security](), [container images](), [Containers](), [chainguard libraries](), [GitHub]() Tags: [chainguard](), [chainguard-containers](), [chainguard-libraries](), [container-images](), [container-security](), [containers](), [funding](), [fundraising](), [git](), [github](), [hardening](), [open-source](), [open-source-security](), [safe-source-for-open-source](), [security](), [series-d](), [software-supply-chain-security](), [supply-chain](), [testing](), [valuation]() ### AI overview Chainguard announces a $356 million Series D round at a $3.5 billion valuation to advance its mission of securing the open source supply chain. The company describes growth in its Containers product and explains how the Chainguard Factory builds, patches, updates, tests, and hardens packages and repositories. It also announces Chainguard VMs and Chainguard Libraries. ### Source excerpt Chainguard has raised $356M of Series D funding at a $3.5B valuation. See how we are building the safe source for all open source. ## Evaluating Container Security with Container Hardening Priorities: Some CHPs for Your SLSA DevFeed: [Evaluating Container Security with Container Hardening Priorities: Some CHPs for Your SLSA]() Original publisher: [Read original article]() Published: 2025-04-03T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [container-security](), [container images](), [supply-chain-security](), [Security]() Tags: [best-practices](), [chainguard](), [chainguard-containers](), [chainguard-images](), [chps](), [configuration](), [container-hardening-priorities](), [container-image](), [container-images](), [container-security](), [hardening](), [minimalism](), [provenance](), [security](), [security-best-practices](), [slsa](), [standard](), [supply-chain-security](), [vulnerabilities]() ### AI overview Chainguard introduces Container Hardening Priorities (CHPs), a framework for assessing container image security. CHPs complements SLSA and focuses initially on build-time characteristics including minimalism, provenance, configuration and metadata, and vulnerabilities. ### Source excerpt Chainguard has announced Container Hardening Priorities (CHPs), a new framework to assess the security of container images. Learn how it works. ## What FedRAMP 20x Means for You DevFeed: [What FedRAMP 20x Means for You]() Original publisher: [Read original article]() Published: 2025-04-02T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Automation](), [authority to operate](), [chainguard](), [chainguard containers](), [container-security](), [cve remediation](), [Security]() Tags: [authority-to-operate](), [automation](), [chainguard-containers](), [complexity](), [compliance](), [container-security](), [cost](), [cve-remediation](), [cves](), [fedramp](), [fedramp-20x](), [monitoring](), [security](), [vulnerabilities]() ### AI overview The article explains that FedRAMP 20x is intended to streamline the authority-to-operate process through automation and continuous validation. It says the core security and compliance controls are not changing and that the existing agency-based FedRAMP Rev. 5 authorization path remains active. ### Source excerpt FedRAMP 20x is a new initiative designed to automate and simplify the FedRAMP process. Get the rundown on what is changing, and how Chainguard can help. ## Snyk Helps Secure the Golang Bento Project DevFeed: [Snyk Helps Secure the Golang Bento Project]() Original publisher: [Read original article]() Author: Phill Garrett Published: 2025-03-12T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Vulnerabilities](), [open-source-security](), [streaming-data-processing](), [Kafka](), [CI/CD]() Tags: [blog](), [ci-cd](), [container-security](), [developer](), [engineering](), [go](), [golang](), [interest](), [kafka](), [maintainers](), [open-source](), [open-source-security](), [pull-request](), [releases](), [security](), [snyk-open-source](), [streaming-data-processing](), [vulnerability]() ### AI overview Snyk describes contributing fixes to the open-source Go project Bento after finding a denial-of-service vulnerability in its SSH dependency. The post also outlines Bento's streaming-data role and Snyk's program for open-source maintainers. ### Source excerpt Discover how Snyk helps secure the open source Golang project Bento by contributing vulnerability fixes and leveraging AI-powered tools. Learn about our efforts to enhance Bento's security and support open source maintainers through the Snyk Secure Developer Program. ## Chainguard Images are the Gold Standard for PCI DSS v4.0 DevFeed: [Chainguard Images are the Gold Standard for PCI DSS v4.0]() Original publisher: [Read original article]() Published: 2025-02-03T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard images](), [container-security](), [Containers](), [supply-chain-security](), [vulnerability management]() Tags: [chainguard](), [chainguard-images](), [chainguard-sboms](), [compliance](), [container](), [container-image](), [container-image-compliance](), [container-images](), [container-security](), [containers](), [cryptography](), [financial](), [pci-dss](), [pci-dss-v4-0](), [sboms](), [software-bill-of-materials](), [software-composition-analysis](), [software-supply-chain](), [stig](), [vulnerability](), [vulnerability-management]() ### AI overview The article explains how Chainguard Images can support selected PCI DSS v4.0 container-security controls. It focuses on asset and vulnerability management, hardened images, FIPS cryptography, build-time SBOMs, software supply chain inventory, and continuously updated containers. ### Source excerpt Chainguard Images are designed to make container image compliance for PCI DSS v4.0 easy for any company involved in card transactions. ## 10 Docker Security Best Practices DevFeed: [10 Docker Security Best Practices]() Original publisher: [Read original article]() Author: Liran Tal; Omer Levi Hevroni Published: 2025-01-08T18:58:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Docker](), [container-security](), [Dockerfile](), [supply-chain-security](), [Kubernetes]() Tags: [acquisition](), [alpine](), [awareness](), [base-images](), [c](), [cheat-sheet](), [container-security](), [debian](), [developer](), [devops](), [devrel](), [devsecops](), [distroless](), [docker](), [go](), [google](), [security](), [security-best-practices](), [snyk-container](), [supply-chain-security](), [vulnerabilities]() ### AI overview This article explains Docker security across image builds, container runtime, supply-chain risks, and orchestration. It presents best practices including using minimal or distroless base images, multi-stage builds, reducing attack surface, and running containers with the least privilege. It also references Docker Hub, Kubernetes, Helm, Alpine Linux, Go, C, Debian, Node, and Google distroless images. ### Source excerpt Understand the basics of Docker security best practices with our Docker Cheat Sheet to improve container security. ## Snyk-Generated SBOMs Now Include License Details for the Open Source Libraries in Your Projects DevFeed: [Snyk-Generated SBOMs Now Include License Details for the Open Source Libraries in Your Projects]() Original publisher: [Read original article]() Author: Jamie Smith Published: 2024-12-09T05:00:00Z Content type: release Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Developer Tools](), [Vulnerabilities]() Tags: [awareness](), [blog](), [compliance](), [container-security](), [developer](), [devops](), [feature](), [open-source](), [pmm](), [sbom](), [security](), [snyk-container](), [supply-chain]() ### AI overview Snyk-generated SBOMs now include license information for open-source components, helping developers assess license risks, compliance needs, and software supply-chain security. ### Source excerpt Snyk now includes license information in its generated SBOMs, giving developers a clearer picture of their application's components and associated license risks and simplifying compliance and security efforts. This new feature streamlines SBOM creation and empowers developers to make informed decisions. ## Best practices for continuous vulnerability management DevFeed: [Best practices for continuous vulnerability management]() Original publisher: [Read original article]() Author: Liran Tal Published: 2024-10-29T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [vulnerability management](), [Application Security](), [supply-chain-security](), [Cybersecurity](), [DevSecOps](), [AI-assisted coding](), [snyk](), [developer tooling](), [npm]() Tags: [ai](), [application-security](), [awareness](), [best-practices](), [blog](), [container-security](), [devrel](), [devsecops](), [llm](), [open-source](), [open-source-security](), [pycharm](), [python](), [security](), [shift-left](), [snyk](), [snyk-code](), [snyk-container](), [snyk-learn](), [snyk-open-source](), [software-development](), [supply-chain](), [visual-studio-code](), [vs-code](), [vulnerability-insights](), [vulnerability-management]() ### AI overview This article presents continuous vulnerability management as essential for addressing risks from open-source dependencies, supply chain incidents, AI-generated code, and emerging cybersecurity threats. It recommends building a proactive security culture, integrating security throughout the software development lifecycle, providing ongoing training and awareness, and automating security workflows across DevOps and DevSecOps teams. It also advocates shift-left security through tools such as Snyk Code in IDEs including Visual Studio Code and Pycharm. ### Source excerpt By integrating security practices into the development lifecycle, providing continuous education and training, and automating security workflows, organizations can effectively mitigate risks from open-source supply chain incidents, AI-generated code, and emerging threats. Snyk provides the tools and resources to establish a proactive security culture and ensure application security. [Next page]()