Container security videos

Clean Libraries MCP: scan and fix vulnerabilities via prompts

Use Clean Libraries as your MCP Server.

1:41

What Is VEX? How It Tells Which Vulnerabilities Matter

A vulnerability scanner can flag hundreds of CVEs in a single container image, and some of them can’t be exploited where you run it. VEX (Vulnerability Exploitability eXchange) is how a software supplier tells you which ones apply.

• VEX
• SBOM

1:53

SBOMs Explained: What They Tell You and What They Don’t

A critical CVE drops. Is that component in your container image at all? An SBOM answers that in seconds. Whether it puts you at risk is a separate question, and this 2-minute explainer covers both.

• SBOM
• Provenance

3:08

Clean Libraries Demo: Scan and Fix Vulnerabilities in Your IDE

See Clean Libraries in action inside VS Code. As you code, it scans your project dependencies for known vulnerabilities and flags risky libraries directly in the IDE.

• Dependencies
• CVEs

Software Supply Chain Security in Age of AI Era

In this episode of CleanStart Conversations, Ankit Aggarwal, VP - Enterprise Architecture at Coforge, joins us to discuss the growing challenges of software supply chain security in the age of AI. From securing open-source dependencies and container images to verifying AI models and protecting autonomous AI agents, we.

1:38

What Is Container Sprawl?

Container sprawl occurs when container images grow faster than teams can track, secure, and manage them. This video explains the causes of container sprawl, its impact on container security, and why visibility across registries, clusters, and running workloads matters.

• Container sprawl
• Security posture

1:45

Meet CUBR, Your Guide to Trusted Software

Forged from precision, powered by trust, and built on the principles of secure-by-design, CUBR represents CleanStart's vision for a safer software supply chain.

• Supply chain
• Provenance

2:39

Clean Libraries: Secure Software Dependencies at the Source

Every release introduces hundreds of dependencies, including transitive packages and AI-generated libraries. Without verification, untrusted components become part of your software supply chain.

• Dependencies
• Supply chain

1:29

What Is Provenance in Containers?

Container provenance is a verifiable record of where a container image came from and how it was built. This video explains what provenance captures, why most images don't include it, and how a signed record lets you catch tampering before an image reaches production.

• Provenance
• Supply chain

2:33

Public vs Hardened vs CleanStart Images

Every container starts with a base image, but not all base images are built the same. This video compares Public Images, Hardened Images, and CleanStart Source-Built Images to show how image composition impacts vulnerabilities, attack surface, and trust.

• Base images
• Attack surface

0:59

Base Images Explained in 60 Seconds

A base image is the foundation that everything else is built on, from dependencies to application code. In this 60-second explainer, discover what a base image is and why choosing the right one matters.

• Base images

2:11

What Is a Shell-Less Container? Container Security Decoded

Most production containers ship with a shell they never use. It sits inside the runtime as convenience tooling, and it quietly becomes one of the easiest paths for an attacker to turn a single vulnerability into full operational control.

• Attack surface
• Base images

1:13

CleanSight: Complete Software Security Posture Management

Introducing CleanSight, a complete Software Security Posture Management platform designed to give you unified visibility across your infrastructure, clusters, and containers.

• Security posture
• CVEs

2:34

CVE Fatigue Explained: Why Your Vulnerability Backlog Never Gets Shorter

2,000 CVEs flagged. Your team patches, rebuilds, redeploys. Next week: 500 more. The cycle repeats. This video breaks down what CVE fatigue is, where it actually comes from, and how teams escape it.

• CVEs
• Base images

1:57

BusyBox in Containers: The Risk Nobody Talks About

BusyBox ships in 85% of lightweight container images. A single C binary from 1996, bundling 300+ utilities into one executable. 47 CVEs in five years. Nobody on your team installed it. Nobody reviewed it. It just showed up.

• Attack surface
• Base images

2:40

What Is Attack Surface in Containers?

Your container image has hundreds of packages. How many does your application actually need? Probably fewer than you think, and every extra one is a potential vulnerability.

• Attack surface
• Base images