Engineering notes on Kubernetes SBOMs, vulnerability scanning, and EU software compliance from the team building StackRadar.
10 min read
Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Find every running image with PHP, see which Helm charts ship it, and learn why OSV-based scanners miss some.
12 min read
Self-hosted vulnerability management: Trivy Operator, Kubescape, Harbor, Dependency-Track, DefectDojo, a CronJob or StackRadar CE, and what each makes you run.
11 min read
A CVE lands in Slack. Four steps answer “are we running it, and where?” from what the kubelets report: digests, one SBOM each, the ID’s aliases, then the pods.
10 min read
One CycloneDX SBOM per image digest the kubelets run, not per Dockerfile: list the digests, run Syft once each, keep the files by digest, and re-match them.
11 min read
Four tiers, the thresholds behind each, and a script that joins Grype or Trivy JSON with the EPSS and KEV feeds. On a real nginx image, 497 CVEs became 12.
12 min read
Split a scan into base-image findings, packages your Dockerfile added, and images you do not build, with Syft, Grype and a script. Then fix each the right way.
12 min read
One CronJob, a read-only ServiceAccount, Trivy, and results in a bucket instead of etcd: the Dockerfile, the YAML and the script, SBOMs built once per digest.
12 min read
Given a package name, list every pod that runs it, its Deployment or DaemonSet and its Helm release: one SBOM per running digest, a jq query and a digest join.
8 min read
Server, dashboard and chart on GitHub under AGPL-3.0, scanner and CLI under Apache-2.0. One Helm command installs the lot in your cluster; nothing leaves it.
10 min read
Most scanners match an image once. We mirror OSV.dev hourly, EPSS and KEV daily, and re-match every stored SBOM when it changes. How, and what it leaves open.
10 min read
We compared our scanner with Trivy and OSV-Scanner on one Helm chart. It invented 140 findings on one image and missed every OS finding on three distros.
9 min read
Trivy Operator stores each report as one object in etcd, and a big image does not fit. How to find the reports it silently dropped, and what each fix costs.
7 min read
A container scan mixes three kinds of finding: your dependencies, the base image and images others build. How to split them without hiding an exploited CVE.
5 min read
Introducing stackradar scan: a free, Apache-2.0 CLI that finds known and exploited CVEs in every image your cluster runs. No agent, no account, no telemetry.
9 min read
What the CISA KEV catalogue is, why it should be your first filter, and a free kubectl + curl script that checks every image running in your cluster against it.
9 min read
Container vulnerability scanning tools sorted by job: Trivy, Grype, Docker Scout and Snyk for an image in CI or a registry, and what scans a running cluster.
8 min read
EPSS score explained: what the 30-day exploitation probability means, how to read the percentile, which threshold to act on, and how it reorders a CVSS list.
8 min read
Syft, Trivy, Docker Scout and cdxgen compared: the current command for each, where each is best, and why an SBOM of what your cluster runs needs another tool.
8 min read
Open-source vulnerability scanners for Kubernetes: Trivy Operator, Kubescape, Grype, Syft, OSV-Scanner and the StackRadar CLI, and what each leaves to build.
8 min read
Open-source and paid Kubernetes security tools sorted by the job they do: posture, vulnerabilities, admission, runtime, network, secrets and supply chain.
6 min read
Use CycloneDX for container and Kubernetes vulnerability work, SPDX for licence compliance or when a customer asks for it. Why, and what regulators accept.
10 min read
A CVE in a Kubernetes pod is fixed by a new image, not apt-get. How backports change “fixed in”, what “no fix” and “won’t fix” mean, and the patching order.
7 min read
CRA reporting has applied since 11 September 2026; the SBOM requirement follows on 11 December 2027. Who is in scope and what Kubernetes teams need.