Container and image setup

Day-1 setup for the three Seal products that work at the container-image layer.

This section covers the three Seal products that operate at the container-image layer: Seal Base Images (sealed replacements for public base images), Seal My Container (sealing your own private container images), and Seal Vendor Apps (sealing the open-source content of vendor-supplied containers you run). Each is the canonical setup home for its product.

The three chapters in this section are independent. A team that ships its own application containers and pulls a sealed Python base image only needs Seal Base Images. A team that also seals private images of its own needs Seal My Container too. A team that runs vendor-supplied images (a Kafka image from Confluent, a database image from Oracle) needs Seal Vendor Apps.

• Seal Base Images: drop-in sealed replacements for public container base images.

• Seal My Container: sealing the customer's own private container images.

• Seal Vendor Apps: sealing the open-source content of vendor-supplied images.

How this section relates to the rest of the platform

Container and image setup operates at the image layer rather than the dependency layer that Application and OS setup covers. The two complement each other:

• Application and OS setup seals the packages inside an image during the image's own build (Seal Apps via the CLI, Seal OS via seal fix --os).

• This section seals the image as a whole — either by replacing an upstream image (Seal Base Images), by re-sealing a private image you maintain (Seal My Container), or by sealing the open-source pieces of a vendor image you run (Seal Vendor Apps).

A typical container delivery setup uses both: a sealed base image, plus the application's own dependencies sealed via the CLI on top.