Container Scanning Without the Security Theater
Most container scanning setups generate noise, not security. Here is how to build a pipeline that actually catches what matters.
Docker
Definition
Docker coverage in this archive spans 5 posts from Feb 2016 to Jul 2022 and focuses on reliability, delivery speed, and cost discipline as one system, not three separate concerns. The strongest adjacent threads are containers, devops, and security. Recurring title motifs include container, security, containers, and docker.
What the archive argues
- Most posts prioritize predictable operations over feature breadth or stack novelty.
- The consistent theme from 2016 to 2022 is disciplined execution over hype cycles.
- This topic repeatedly intersects with containers, devops, and security, so design choices here rarely stand alone.
Execution checklist
- Set SLOs first, then choose tooling that keeps deploy, observability, and rollback simple.
- Start with the newest post to calibrate current constraints, then backtrack to older entries for first principles.
- When boundary questions appear, cross-read containers and devops before committing implementation details.
Common failure modes
- Adding platform layers faster than the team can operate and debug them.
- Chasing throughput gains without proving they improve end-user reliability.
- Applying guidance from 2016 to 2022 without revisiting assumptions as context changed.
Suggested reading path
- Start here (current state): Container Scanning Without the Security Theater
- Then read (operating middle): Your Containers Aren’t Secure. Here’s What to Actually Do About It.
- Finish with (foundational context): Docker in Production: What We Learned Running Containers at Dropbyke
Related posts
- Container Scanning Without the Security Theater
- Container Security in 2018: What Actually Changed
- Your Containers Aren’t Secure. Here’s What to Actually Do About It.
- Container Orchestration: Docker Swarm vs Kubernetes vs Mesos
- Docker in Production: What We Learned Running Containers at Dropbyke
References
Container Security in 2018: What Actually Changed
Eight months after my first container security post, an update on what moved at the fintech startup and in the ecosystem — PodSecurityPolicy, image signing, and the shift from scratch to real.
Your Containers Aren't Secure. Here's What to Actually Do About It.
Containers give you process isolation, not a security boundary. I break down how we hardened images, locked down runtimes, and segmented networks at the fintech startup — plus the stuff nobody warns you about.
Container Orchestration: Docker Swarm vs Kubernetes vs Mesos
A side-by-side comparison of Swarm, Kubernetes, and Mesos based on running all three in evaluation at Dropbyke. Kubernetes is going to win, but the operational tax is real.
Docker in Production: What We Learned Running Containers at Dropbyke
Running Docker in production at Dropbyke forced us to get serious about image builds, container networking, log aggregation, and security. Here is what actually worked.