Blog
Engineering notes on Kubernetes SBOMs, vulnerability scanning, and EU software compliance from the team building StackRadar.
· 8 min read
Introducing the StackRadar CLI: scan what your cluster is actually running
stackradar scan is a free, Apache-2.0 CLI that finds known and exploited CVEs in every image running in your Kubernetes cluster — no agent, no account, no telemetry. Why it enumerates from the kubelet instead of your manifests, and what it deliberately does not do.
announcementsopen sourceCLI· 8 min read
CISA KEV: which of your running Kubernetes images are on the list
What the CISA Known Exploited Vulnerabilities catalog is, why it should be the first filter on any vulnerability list, and a free kubectl + curl script that checks every running image in your cluster against it.
KEVprioritisationfree tools· 11 min read
Container vulnerability scanning tools in 2026, by job
Trivy, Grype, Docker Scout, Snyk Container, Kubescape, Trivy Operator and StackRadar, sorted by what you are actually scanning: a CI image, a registry, or a running cluster. Which fits which job, and where each stops.
comparisonscontainer scanning· 9 min read
EPSS score explained for Kubernetes operators
What an EPSS score actually measures, how to read the percentile, which threshold to act on, and a worked example from a real cluster showing why EPSS reorders the CVSS list so drastically.
EPSSprioritisation· 10 min read
SBOM tools compared: Syft, Trivy, docker sbom, and cluster-level SBOMs
How to generate an SBOM with Syft, Trivy, docker sbom, cdxgen and Docker Scout, what each is best at, and why a cluster-level SBOM of what is running is a different tool from any of them.
SBOMcomparisonsSyft· 10 min read
Open-source vulnerability scanners for Kubernetes: what each one does and does not do
Trivy Operator, Kubescape, Grype and Syft, OSV-Scanner, the StackRadar CLI, and what became of KubeClarity — compared by what they scan, where results live, and what you still have to build yourself.
open sourcecomparisonsKubernetes· 12 min read
Kubernetes security tools, by what they actually do
Open-source and paid Kubernetes security tools sorted into the jobs they do — posture, vulnerabilities, policy, runtime, network, secrets and supply chain — instead of a top-ten list. Which layer each covers, and which it does not.
Kubernetescomparisons· 8 min read
CycloneDX vs SPDX: which SBOM format to use, and when it matters
The two SBOM standards side by side — origins, what each models, tool support, regulatory acceptance under the CRA and US guidance — and a plain recommendation for container and Kubernetes teams.
SBOMCycloneDXSPDX· 11 min read
CVE patching in Kubernetes: fix versions, base images, and what "fixed" means
Why a CVE in a running pod is patched by a chart bump or a base-image rebuild rather than apt-get, how distro backports make version numbers lie, what "no fix available" and "won’t fix" really mean, and how to sequence the work.
remediationCVEbase images· 6 min read
What the EU Cyber Resilience Act means for your Kubernetes SBOMs
The CRA makes machine-readable SBOMs and 24-hour vulnerability reporting law for software sold in the EU from 11 September 2026. What platform teams need.
complianceCRASBOM· 7 min read
StackRadar vs Trivy Operator: managed fleet visibility vs in-cluster CRDs
Trivy Operator is excellent at in-cluster scanning with results as Kubernetes CRDs. Where that model works, where it runs out of road, how StackRadar differs.
comparisonsTrivy Operator