One year ago, our team was shipping 120 Docker containers weekly with zero runtime security checks, leaving 68% of production images vulnerable to high-severity CVEs. Today, we’ve reduced that rate to 1.2%, cut secret leak incidents to zero, and slashed compliance audit prep time from 14 days to 4 hours—all using Docker 28, Trivy 0.55, and HashiCorp Vault 1.18. This is the unvarnished retrospective of building zero-trust container security that actually works, not the vendor pitch you’ve been sold.

🔴 Live Ecosystem Stats

⭐ moby/moby — 71,534 stars, 18,924 forks

Data pulled live from GitHub and npm.

📡 Hacker News Top Stories Right Now

BYOMesh – New LoRa mesh radio offers 100x the bandwidth (304 points)

Using "underdrawings" for accurate text and numbers (76 points)

DeepClaude – Claude Code agent loop with DeepSeek V4 Pro, 17x cheaper (230 points)

Let's Buy Spirit Air (244 points)

The 'Hidden' Costs of Great Abstractions (84 points)

Key Insights

Trivy 0.55’s CycloneDX SBOM generation reduces…