Container Security FAQ

No. Your application stays exactly the same. You only replace the FROM line in your Dockerfile with an ImageSentinel-hardened base image.

In under 60 seconds. Just change the FROM line in your Dockerfile to an ImageSentinel base image — no additional setup required.

No. We preserve full ABI compatibility. We rebuild and harden the OS layer, not your application logic.

No. Our hardened images are drop-in compatible. If your pipeline works today, it will work with ImageSentinel — only more secure.

We rebuild the OS layer, sanitize dependencies, recompile binaries with secure toolchains, and verify everything through automated hardening pipelines. Each release is scanned, signed, and provenance-verified before publishing.

ImageSentinel rebuilds the OS layer from scratch using a hardened minimal base with zero legacy packages. All hardening, dependency sanitization, patching, signing, and verification is performed by ImageSentinel's automated security pipeline.

No. Scanners only detect vulnerabilities. ImageSentinel removes vulnerabilities by rebuilding and hardening the entire OS and dependency layer end-to-end.

We only replace vulnerable or unpinned dependencies with secure, binary-compatible versions. Your application logic is never modified.

Production images are minimal and shell-free, but debugging is fully supported using ephemeral debug containers or debugging sidecars without exposing shells in production.

No. ImageSentinel images are typically 30–60% smaller, start faster, and contain zero OS bloat or unnecessary packages.

Anything that runs in a container — including Python, Node.js, Go, Java, Rust, .NET, PHP, and more.

Yes. All hardened ImageSentinel images run rootless by default.

Yes. All images include full signing, SBOM, provenance, and rootless support for production workloads.

Each image includes a complete SBOM, provenance metadata, and a signed change record of all layers involved in the hardening process.

Continuously. We monitor upstream CVEs in real time and rebuild hardened images as soon as patches become available.

We provide update notifications, version tags, and automated changelogs whenever a rebuild includes new security fixes.

Chainguard focuses heavily on enterprise licensing. ImageSentinel delivers the same level of hardening but with a developer-first workflow, transparent tooling, and accessible pricing.

Yes. ImageSentinel images work with ECR, GCR, ACR, Harbor, Artifactory, and any OCI-compatible registry.

Yes. We support custom builds tailored to your dependency graph, runtime, compliance requirements, and performance needs.

Self-hosted and air-gapped editions are planned for customers requiring strict compliance and data governance.