GuidesContainer image security, FIPS and fixes
Guides
01How to build FIPS-enabled containers (FIPS 140-3)Build a FIPS-enabled container image: which crypto modules need a FIPS 140-3 certificate, how to turn FIPS mode on inside the image, and how to prove it with a live test.02OCImend FIPS containers: what you get and how they are verifiedOCImend FIPS containers are existing images with FIPS mode enforced and verified live: validated module, rescan, smoke test and a pull command pinned by digest.03How to fix container image CVEs automaticallyFix CVEs in a container image automatically: upgrade vulnerable OS packages in a sandbox, rescan, smoke-test, and rebuild again when the distribution ships new fixes.04A container vulnerability pipeline that ends in a fix, not a reportDesign a container vulnerability management pipeline: scan, prioritise with KEV and EPSS, fix, verify, gate in CI and monitor, with SBOM, SARIF and VEX outputs.05"No fix available": what to do about unfixable container CVEsWhy scanners report hundreds of CVEs with no fix (Debian no-dsa, postponed, ignored) and the three ways out: a measured slimmer base, watch-and-rebuild, and VEX.06Base image or your layers? Finding which Dockerfile step introduced a CVEAttribute each container vulnerability to the layer and Dockerfile instruction that installed it, and split the fix between the base image and your own layers.07EU Cyber Resilience Act for container images: SBOM, VEX and 24-hour reportingWhat the EU CRA means for container images: exploited-vulnerability reporting from 11 September 2026, SBOMs by December 2027, and how SPDX, CycloneDX and OpenVEX fit.