Container Dependency Firewall

Block vulnerable and malicious container images before they reach your build agents, CI/CD pipelines, and production environments.

The same policy engine, audit logging, and registry-proxy architecture that runs Package Dependency Firewall for npm, Maven, PyPI, NuGet and Go, applied to OCI registries.

See how it works

npm Maven PyPI NuGet GoContainers

What Container Dependency Firewall will do

The same controls that block risky packages in npm, Maven and PyPI pipelines, applied to every container image pull.

OCI registry proxy

Route container pulls through Dependency Firewall. Every image request is evaluated against your policies before the image reaches a build agent or production node.

Vulnerability blocking

Block images with known CVEs in base layers or bundled packages. Filter by CVSS and EPSS severity. New advisories take effect without redeploying the firewall.

Malware and secrets scanning

Detect malicious payloads, hardcoded secrets, and suspicious layer mutations before an image runs in your environment.

Policy engine

Rules by image name, tag pattern, registry source, base image, license, and age. Block or log-only, with time-limited exceptions.

Audit logging

Every pull, block, and exception is recorded. Exportable to your SIEM. Full trail for compliance and incident response.

Works with your existing registry

Proxies Docker Hub, GitHub Container Registry, AWS ECR, Google Artifact Registry and private OCI registries. No changes to your image references.

Package firewalling across five ecosystems

Bytesafe Package Dependency Firewall covers npm, Maven, PyPI, NuGet and Go. Container Dependency Firewall extends the same firewall to OCI images.

npm Maven PyPI NuGet Go

Interested in Container Dependency Firewall?

Get in touch and we'll reach out before general availability with early access details.