Docker Advocates Build-Time SBOMs Over Post-Build Scanning for Container Security

·1 views

Docker published a guide on June 25 outlining best practices for generating Software Bills of Materials (SBOMs) in container workflows. The guide argues that SBOMs generated at build time using BuildKit attestations are more reliable than those produced by scanning finished images after the fact, as they capture the full resolved dependency tree. Post-build scanners, while useful for third-party images, can miss statically linked binaries, vendored dependencies, and packages from intermediate build stages. Docker recommends attaching signed SBOM attestations directly to image digests and enforcing their presence as a deployment gate in CI/CD pipelines. The approach is increasingly relevant as regulations like US Executive Order 14028 and the EU Cyber Resilience Act require verifiable SBOMs for software sold to government and commercial markets.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

DEV Tutorial: Containerise a Node.js App and Run It on Local Kubernetes

A new tutorial series titled 'DevOps 101' guides developers through building and deploying a Node.js Todo API from scratch using Docker and Kubernetes. Part 1 covers writing a small Express-based app, packaging it as a Docker image, and setting up a local Kubernetes cluster using the tool 'kind'. Developers then deploy the app using raw YAML manifests to understand how Kubernetes operates internally. The guide supports macOS, Linux, and Apple Silicon machines, with step-by-step installation instructions for all required tools. The full series spans 15 parts, progressively adding databases, Helm charts, GitOps with ArgoCD, CI pipelines, and observability tooling.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How one developer manages a 40-package monorepo with Turborepo, Bun, and Biome

A solo developer built and maintains flare-engine, a modular 2D engine for React Native and Web spanning 40 packages, using a toolchain of Turborepo, Bun, and Biome. The core principle is strict configuration discipline: exactly one root-level config file governs all packages, eliminating per-package ESLint or build configs entirely. Bun serves triple duty as the package manager, test runner, and runtime, while Biome handles linting and formatting across the entire repo in a single pass. Turborepo orchestrates build, test, lint, and typecheck tasks through a shared turbo.json, with Changesets managing versioning and releases. A custom CI script enforces dependency boundaries, failing the build immediately if any package imports from a tier it should not access.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

MCP Context Contracts Help AI Tools Draft Safer Android Automation Workflows

When AI assistants like Codex or Claude are asked to generate Android automation workflows, vague natural-language instructions alone are insufficient for reliable execution on real devices. A concept called a 'context contract' addresses this gap by requiring the AI to first read a structured set of facts — including target environment, device state, app package, node schema, and available assets — before drafting any workflow. The Model Context Protocol (MCP) provides a standardized way for AI models to query local systems for this structured context, reducing hidden assumptions that often lead to flawed automation. In the LaiCai Flow framework, the AI handles drafting based on MCP-supplied context, while LaiCai Flow itself manages execution, debugging, screen interaction, and logging. The recommended sequence — read context first, draft second, review third, run fourth — is designed to make AI-generated automation profiles safer, more auditable, and less prone to runtime failures.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Platforms Quietly Took Ownership of Your Reading List Away From You

For decades, RSS and Atom feeds allowed anyone to follow websites freely, without accounts or algorithms controlling what they saw. As social platforms grew, they replaced open feeds with login-gated follow systems, trapping readers inside their databases. Sites stopped publishing feeds because platform audiences were too large to ignore, making the shift feel invisible to most users. Today, a reader's subscriptions survive only as long as a platform chooses to maintain them, unlike the old model where feeds lived in tools users controlled. Advocates are now calling for a return to feed-first infrastructure that puts content discovery back in the hands of readers, not platforms.

0 comments Read more at DEV Community