Seal My Container
Container-to-container sealing of your private container images.
Last updated
Container-to-container sealing of your private container images.
Seal My Container produces a sealed copy of your existing private container images. You feed Seal an image; Seal returns a sealed image that you push to your own registry. Vulnerable open-source packages, runtimes, and embedded artifacts inside the image are replaced with sealed versions; your own first-party application code is not touched.
Inside the input container image:
OS-level packages, across the same Linux distributions as Seal OS: APK (Alpine), DEB (Debian, Ubuntu), and RPM (RHEL, and others).
Language runtimes installed in the image.
Open-source dependencies bundled as standalone artifacts (typically JAR files and Python wheels).
Seal My Container does not modify your own first-party application code.
Seal My Container runs as a Seal CLI command, typically from a centralized re-seal pipeline that processes a list of your container images. The output is a new container image you push to your registry under a name you choose. This pattern, container-to-container sealing, makes "fix the open-source software in every image we build" a single pipeline step instead of a per-image project.
For pre-built open-source artifacts inside the image (JARs, Python wheels), Seal My Container uses post-build artifact sealing.
Setting up Seal My Container: day-1 setup.
Working with Seal My Container: the day-to-day workflow.
Last updated