Container hardening at fleet scale, with the proof that it still runs.
The Tracepod platform puts a dashboard, automated validation, and compliance tooling on top of the open-source hardening engine. It deploys into your cluster via Helm; no data leaves your infrastructure. You see exactly what every workload has been hardened to, and whether it passed a live sandbox test.
CVE counts, size savings, and coverage for every workload in the cluster.
The dashboard gives you a fleet-wide picture: which workloads have been profiled, hardened, validated, and applied. See CVE counts, image size savings, and coverage scores at a glance. Drill down to individual builds to inspect the manifest, confidence scores, and sandbox results.
- Fleet summary with attention items (drift, failed validations, missing coverage)
- Per-workload build history and lineage
- Live updates as builds and validations run
- Full audit log, exportable
Prove the hardened image works before you ship it.
Tracepod spins up an ephemeral copy of your hardened container, cloning the workload’s pod template (env vars, secrets, config maps, ports). It runs the readiness probe, captures logs, and waits for the sensor to report back. Missing files are detected and surfaced before the image ever reaches production.
- Full pod-spec fidelity (env, secrets, ConfigMaps, commands)
- Readiness probe reused as health check
- Missing-file diff against the hardened manifest
- Pass/fail result stored with the build record
Pushing hardened image to sandbox registry…
Creating ephemeral pod in tracepod-sandbox…
Waiting for readiness probe…
✓ Pod healthy (12.4s)
Capturing sensor profile…
Diffing against hardened manifest…
✓ No missing files detected
✓ Validation PASSED
Cleaning up pod…
✓ Official image auto-pushed
Failed validations fix themselves.
When sandbox validation finds missing files, the auto-fix loop rebuilds the image with those paths included and validates again, up to three rounds without anyone watching. Missing paths come from the sensor diff and from ENOENT lines in the container logs. In our postgres test, a build that crashed on missing ICU locale data came back green after two rounds. Every auto-fixed build keeps its provenance: which build it repaired, and on which round. Webhooks fire when the loop finishes, either way.
See exactly how many vulnerabilities you removed.
After each build, Tracepod runs grype against both the source and hardened images and computes the delta. CVE counts by severity are stored on the build record and surfaced in the dashboard. These are the numbers your security team will ask for.
- grype scan of source vs hardened image
- Counts broken down by severity
- Stored on the build record, queryable via API
- OpenVEX export with reachability for false-positive suppression
Define what “hardened” means per namespace, then see which workloads miss it.
Define policies per namespace (glob-matched): minimum manifest coverage, hardened image required, sandbox validation required. The /compliance endpoint evaluates every workload against applicable policies and returns a pass/fail matrix you can gate deployments on or feed into GRC tooling.
- Namespace-glob scoped policies
- Min coverage, hardened-required, validated-required
- Fleet compliance report via
GET /api/v1/compliance - RBAC-gated: Operator to write, Viewer to read
Also in the platform
Apply & drift detection
Roll the hardened image out to the live workload from the dashboard (Admin role, with confirmation). The attention panel alerts when the live image drifts from the hardened version.
Webhooks + source-image watching
Configure a webhook_url to receive build, validation, and autofix events as JSON. Source-image watching polls upstream digests and triggers auto-rebuild when they change.
RBAC via Kubernetes TokenReview
No new identity system. Bearer tokens are validated by the K8s API server. Roles (Viewer, Operator, Admin) are set in a ConfigMap. Works with any OIDC-backed Kubernetes cluster.
Append-only audit log
Every action (build, push, validate, apply, policy change) is recorded with user, timestamp, and structured metadata. Exportable as CSV or JSON.
OpenVEX export with reachability
Generate machine-readable VEX documents based on whether a vulnerable component is actually present in the minimised image. Suppresses false positives in scanner output.
Registry management
Store target registry configs (host, repository path, tag strategy, TLS, K8s secret) in the platform. Test connectivity before saving. Support for anonymous and authenticated pushes.
Book a demo. Bring one workload.
We’ll show you the hardened image, the CVE delta, and the sandbox pass, live, on a workload like yours.