DevSecOps Archives

CI/CD, GitOps, pipelines, Jenkins, kubernetes, kpack, buildpacks, CI/CD, Codefresh, Komodor, AI, clusters, kubernetes, generative AI Kubernetes Argo container security continuous SQL Server Windocks Tekton Kubeflow Red Hat CI/CD

Where DevOps Pipelines Break: Real Attack Paths in Cloud-Native CI/CD

While traditional security focuses on perimeters, modern attackers are moving upstream to the CI/CD pipeline. By compromising the build process rather than the final product, they can inject malicious code into trusted ...

Alex Vakulov | May 11, 2026 | Artifact Integrity, Build Server Vulnerabilities, CI/CD security, Dependency Poisoning, DevSecOps, Kubernetes security, Pipeline Hardening, Secret Management, SolarWinds Incident, Supply Chain Attacks

state, stateless, kubernetes, scanning, cloudsmith, stateless ephemeral stateful security Kubernetes unikernel Sumo Logic

Java Code Isn’t the Problem – The Container Is

Learn how integrating Docker Scout into Java CI pipelines shifts container security left, replacing manual reviews with automated gates to secure base images and dependencies ...

Swapneswar Sundar Ray | May 11, 2026 | base image vulnerabilities, CI/CD pipeline, container security, DevSecOps, Docker Scout, GitHub Actions, Java security, jenkins, Maven dependencies, shift left security

OWASP Has Adopted DockSec and the Cloud Security Community Is Taking Notice

With more than 13,000 downloads across more than 40 countries, DockSec has earned its place as an OWASP Incubator Project by doing something most container security tools have not managed: closing the ...

Puspita Pradhan | April 30, 2026 | CI/CD, container security, DevSecOps, kubernetes, open source

CleanStart Takes Aim at BusyBox to Harden Container Security

Container security faces a significant "inheritance risk" through BusyBox, a legacy utility package embedded in popular base images. CleanStart addresses this with a new BusyBox-free container architecture, replacing inherited userspace utilities with ...

Tom Smith | April 8, 2026 | Alpine Linux Alternative, Build-time Validation, BusyBox-free, CleanStart, container security, Deterministic Runtime, DevSecOps, minimal container images, SBOM, software supply chain

Slim.AI Docker OpsRamp Extends AIOps Reach to Kubernetes

The New Multi-Tenant Challenge: Securing AI Agents in Cloud-Native Infrastructure

AI agents run untrusted code. Here’s how to secure them using isolation, least privilege and proven cloud-native patterns ...

Ben Wheatley | March 20, 2026 | AI agents, cloud native security, container security, DevSecOps, least privilege, Multi-tenancy

Survey Surfaces Raft of Container Security Challenges

A BellSoft survey reveals gaps in container security practices, showing that human error, limited vulnerability scanning, and infrequent patching continue to expose cloud-native environments to risk ...

Mike Vizard | January 29, 2026 | BellSoft survey, cloud native security, container patching, container security, DevSecOps, image signing, Kubernetes security, SBOM, software supply chain security, vulnerability scanning

devsecops, supply chain, Kubernetes, practices, DevSecOps, JFrog, DevSecOps, Snyk Cerbos DevSecOps authorization incident Deepfence misconfigured Kubernetes security

Best of 2025: DevSecOps for Kubernetes: 15 Best Practices for 2025

In today’s environment, it is becoming harder to build secure applications. Applications are becoming increasingly complex, relying on more and more dependencies and components provided by vendors than ever before. These components ...

Carey Bishop | December 30, 2025 | best practices, DevSecOps, kubernetes

TLS, certificates, Docker, vulnerabilities, supply chain, KubeCon, SigStore, Kubernetes TrapX container security

Docker, Inc. Adds More Than a Thousand Free Hardened Container Images

Docker is releasing more than 1,000 hardened container images under an open source license, aiming to cut vulnerabilities and strengthen software supply chains ...

Mike Vizard | December 17, 2025 | Alpine containers, cloud native security, container security, CVE management, Debian containers, DevSecOps, Docker AI Assistant, Docker hardened images, docker hub, hardened container images, open source containers, SBOM, SLSA provenance, software supply chain security

5 Reasons Cloud-Native Companies Should Start Adopting Quantum-Safe Security Today

Quantum computing threatens today’s encryption. Learn why cloud-native organizations must adopt quantum-safe security to stay compliant and resilient ...