Security Testing
Container security is different from traditional application security. Your attack surface includes the base image, installed packages, runtime configuration, Kubernetes RBAC, network policies, and more — not just your application code. Aqua Security is purpose-built for this environment. This guide covers what Aqua does, how to integrate it into your
Trivy
Trivy is a fast, comprehensive open-source vulnerability scanner from Aqua Security that scans container images, filesystems, Git repositories, Kubernetes manifests, and IaC files. This guide covers local scanning, GitHub Actions integration, SBOM generation, and managing findings with .trivyignore. Key Takeaways Trivy scans more than just OS packages. It detects
Security Testing
Container image signing closes a critical gap in software supply chain security: verifying that the image running in production is exactly the image your CI pipeline built — and nothing else. Sigstore and its Cosign tool make this practical, with keyless signing that eliminates the burden of managing long-lived private