Even security teams that have invested in a hardened base image often can’t say what’s running on top of it. In a recent survey of 250 North American DevSecOps leaders, 91% named visibility into container components as their single biggest blind spot. Not the base image, but everything layered onto it. And 90% said their teams still run lightly modified public images with little to no hardening. That gap is getting harder to ignore. AI coding assistants are adding dependencies faster than teams can review them. Vulnerability databases can no longer keep pace with the volume of submissions. New regulatory requirements, including the EU Cyber Resilience Act, are also increasing expectations around vulnerability handling, remediation, and software supply chain transparency. Docker Hardened Images meet ActiveState’s Curated Catalog
Docker, Inc. and ActiveState today announced a reselling partnership that brings Docker Hardened Images (DHI) together with ActiveState’s curated open source packages, giving enterprises a more consistent way to secure both the container base and the software dependencies layered on top. DHI provides secure-by-default, minimal container images, with 4,000+ images built from source, near-zero CVEs, signed SBOMs, and SLSA Build Level 3 provenance. The catalog is free and open source under Apache 2…
