Here’s a question that should be embarrassing but isn’t, because nobody can answer it: what CVEs are in the containers you’re running right now?

If you run more than five Docker hosts, the honest answer is probably “I have no idea.” Your latest tag was fresh six months ago. You’re pretty sure one ingress cert isn’t about to expire. You think most images are MIT-licensed but you’ve never actually checked. Most teams find out the bad way — a vendor email, a 2 AM page, an auditor asking pointed questions.

The XIB suite — five focused “in a box” tools shipping today — closes that gap. All open source, all self-hosted, and deployable together or independently.

VIB — Vulnerability in a Box

Trivy is the de facto open-source vulnerability scanner. Running it once is easy. Running it across every image on every host, every night, and actually doing something with the results — that’s the hard part. VIB wires Trivy to VictoriaMetrics for time-series storage and Grafana for a fleet-wide CVE dashboard. Severity filters, host filters, image filters. You see the CVE count drop when you patch. You see it climb when you don’t.

TIB — Threat Intelligence in a Box

VIB tells you that you have 2,400 CVEs. Now what? Patching by CVSS score alone is theatre — a CRITICAL 9.8 nobody’s exploiting is less urgent than a HIGH 7.5 actively used in ransomware campaigns this week. TIB syncs the CISA Known Exploited Vulnerabilities catalogue (~1,200 CVEs with confirmed exploitation in the wild) and EPSS exploitation probability scores from FIRST.org, then cross-references them against your VIB data. Result: “you have 3 CVEs on CISA KEV right now — fix those first” instead of “you have 2,400 CVEs, good luck.” No API keys, no cloud accounts. Works standalone or wired to VIB for the cross-reference that actually matters.

CIB — Compliance in a Box

CVEs aren’t the only thing in your containers. There are licenses. There’s an OS that hit end-of-life six months ago. There’s a base image running as root because somebody forgot the USER directive. CIB generates CycloneDX SBOMs for every image, runs license deny-list checks, tracks OS EOL dates, and scores each image 0–100 on container runtime policy. One number per image, fleet-wide. The kind of number you can actually put on a slide.

PIB — PKI in a Box

Every internal service that does TLS has a certificate. Every certificate expires. The question is whether you find out from a monitoring tool or from a customer. PIB probes TLS endpoints, monitors internal CAs, and ships an expiry timeline dashboard with warning and critical thresholds. It also bundles step-ca so you can actually issue the internal certs you’re monitoring — closing the loop between “we need an internal CA” and “we have one.”

IIB — Identity in a Box

Four new tools, four new Grafana logins. This is how SSO gets neglected — there’s never a good time to wire it up. IIB packages Authentik as a one-command deploy with PostgreSQL, Redis, VictoriaMetrics, and its own Grafana dashboard. Then make setup-sso wires every XIB tool to authenticate against it. PIB’s step-ca even uses IIB as its OIDC provisioner — cert issuance authenticated against your central identity, with audit trail.

XIB — The Umbrella

Five tools is too many entry points. XIB is the umbrella: VIB, TIB, CIB, PIB, and IIB deployed through pinned submodules with one unified Grafana view. Each project keeps its own VictoriaMetrics data store and remains independently deployable; Grafana connects those sources at the decision layer instead of flattening five security domains into one mystery database.

Why now, why all at once

These tools were the unfinished half of self-hosted container ops. OIB and SIB cover what’s happening right now — logs, metrics, runtime detection. AIB covers what depends on what. XIB covers what’s inside your images and who can touch them. Together they’re the picture most teams have been faking for years.

All five are Apache 2.0. All five are on GitHub:

  • VIB — Vulnerability scanning
  • TIB — CISA KEV + EPSS threat intelligence
  • CIB — SBOM, license, EOL compliance
  • PIB — Internal CA + cert monitoring
  • IIB — SSO via Authentik
  • XIB — All of the above, together

Clone with submodules, configure, and run make up. You’ll know more about your container fleet than another spreadsheet or point-in-time scan could tell you. That’s the pitch.