The baseimage Blog
Insights on container security, CI/CD pipelines, and the future of DevSecOps.
Most CVEs in Go Images Aren't Exploitable. How to Prove Which Ones
Prometheus, Grafana, Traefik, Caddy, MinIO — scans of Go-based images return dozens of findings, and most can be ruled out with evidence. Three checks (file, govulncheck, go version -m) that sort real from noise, and VEX to make the dismissals stick.
How to Fix CVEs in Runtime Docker Images — or Prove They Don't Apply
python, node and other runtime images ship with 100+ findings, yet only 18% of critical CVEs stay critical once runtime context is applied. Which ones are real, five steps that cut the count, and how to document the rest with VEX so it passes a security review.
Hardening Grafana: −68% CVEs, the Rest Proven Unreachable
How we cut grafana/grafana:13.0.3 from 54 CVEs to 17: 37 physically removed, 17 proven unreachable with linkage analysis, call graphs and runtime checks. With the Dockerfile, reproduction commands — plus a free hardening playbook you can hand to your AI agent.
Docker Image Vulnerability Scanning: Cut 300+ CVEs Down to What Actually Matters
A scanner returns 300+ CVEs. Most are noise — but not all. We break down a systematic approach: enrich with EPSS and CISA KEV, classify by runtime context, and reduce alert fatigue by up to 70%.