A packaged filesystem (OS layers + app + dependencies) that runs as a container.
A container image bundles an application with everything it needs — OS libraries, language runtime, dependencies — into immutable layers. That convenience concentrates risk: a base image with an unpatched OpenSSL puts the same CVE in every service built on it.
Safeguard verifies container images the same way it verifies packages: vulnerability scanning across every layer, malware analysis, and license inventory. Verified images appear in the Images section of the Gold directory.