Safe containers, from build to cluster.
Containers make it easy to ship, and just as easy to ship an old library with a known flaw. BurstLayer checks your images, watches your clusters and blocks unusual traffic between services.
Every container image carries a small operating system.
That operating system and its libraries age like any other software. An image built last year can contain dozens of known flaws, and a cluster can be running hundreds of copies of it.
What attacks containers and clusters
The risks sit in three places: the images you build, the settings you run them with and the traffic between them.
Old base images
We check images when they are built and while they run, and tell you which ones to rebuild.
Containers with too much power
Containers running as administrator or with access to the host machine. We flag them and suggest safer settings.
Exposed dashboards
Kubernetes dashboards and control endpoints reachable from the internet. We find them and close them.
Cryptominers in clusters
Attackers who get in often run mining software. We catch the unusual CPU use and stop the container.
Secrets inside images
Passwords baked into images or settings. We detect them and help you move them into a proper secret store.
Unexpected traffic between services
A web container suddenly talking to your database's admin port. We alert you and can block it.
Know which containers need a rebuild.
A map of your cluster shows every running container, and lights up the ones built on images with known flaws.
- Flawed images found while they run
- Rebuilds suggested with the safe base image
- Traffic rules between your services
api was built on an image with three published flaws. Rebuilding on the patched image…
How BurstLayer protects Docker and Kubernetes
One small agent per node reports what runs where. Nothing is changed in your cluster without your approval.
Image scanning
Images are checked in your registry before they run, and again when new flaws are published.
A cluster overview
Every node, container and image in one map, with the risky ones on top.
Traffic rules
We learn which services talk to each other and alert on anything new.
A runtime watch
Unknown programs, mining software and odd system calls inside containers are flagged.
Secret checks
Keys and passwords inside images or environment settings are found and reported.
Base-image updates
We open a pull request that moves your Dockerfile to a patched base image.
Install with Helm in one minute.
Helm is the standard package manager for Kubernetes. One install puts the agent on every node in your cluster.
$ helm repo add burstlayer https://charts.burstlayer.com$ helm install burstlayer burstlayer/agent \--namespace burstlayer --create-namespace \--set key=$BURSTLAYER_KEY✓ Agent running on 6 nodes✓ 42 images found. 3 need a rebuild.
Running plain Docker on a single machine? Use the Linux install command instead. It finds Docker on its own.
- 01
Install the agent
One Helm command, or the Linux installer for plain Docker hosts.
- 02
Connect your registry
Give read-only access so images are checked before they ever run.
- 03
Decide what we may change
Start with alerts only, then allow rebuild pull requests and traffic rules.
The products behind it
Each one works on its own. Together they cover Docker & Kubernetes, from the network edge to the last line of code.
Questions, answered.
Which clusters are supported?+
Kubernetes 1.27 or newer, including EKS, GKE, AKS, k3s and clusters you run yourself.
Do you need access to my registry?+
Only read access, so we can check images before they run.
Can BurstLayer stop a running container?+
Only if you allow it. By default we alert you and suggest what to do.
Find the old images in your cluster.
Free for your first cluster. One Helm install and you will see every image that needs a rebuild.