> For the complete documentation index, see [llms.txt](https://docs.sealsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sealsecurity.io/setup-containers.md).

# Container and image setup

This section covers the three Seal products that operate at the container-image layer: **Seal Base Images** (sealed replacements for public base images), **Seal My Container** (sealing your own private container images), and **Seal Vendor Apps** (sealing the open-source content of vendor-supplied containers you run). Each is the canonical setup home for its product.

The three chapters in this section are independent. A team that ships its own application containers and pulls a sealed Python base image only needs **Seal Base Images**. A team that also seals private images of its own needs **Seal My Container** too. A team that runs vendor-supplied images (a Kafka image from Confluent, a database image from Oracle) needs **Seal Vendor Apps**.

* [Seal Base Images](/setup-containers/seal-base-images.md): drop-in sealed replacements for public container base images.
* [Seal My Container](/setup-containers/seal-my-container.md): sealing the customer's own private container images.
* [Seal Vendor Apps](/setup-containers/seal-vendor-apps.md): sealing the open-source content of vendor-supplied images.

## How this section relates to the rest of the platform

Container and image setup operates at the **image layer** rather than the **dependency layer** that [Application and OS setup](/setup-apps-os/choosing-deployment-method.md) covers. The two complement each other:

* Application and OS setup seals the packages **inside** an image during the image's own build (Seal Apps via the CLI, Seal OS via `seal fix --os`).
* This section seals **the image as a whole** — either by replacing an upstream image (Seal Base Images), by re-sealing a private image you maintain (Seal My Container), or by sealing the open-source pieces of a vendor image you run (Seal Vendor Apps).

A typical container delivery setup uses both: a sealed base image, plus the application's own dependencies sealed via the CLI on top.