Trusted content is the foundation security-conscious organizations expect all builds to start from. Docker has made that possible for everyone by providing the foundation free. Docker Hardened Images (DHI) are open source under Apache 2. 0, with a catalog of 4,000+ minimal images (and growing) built from source and continuously maintained by Docker. The catalog also carries customizable Helm charts and over 65,000 hardened system packages. For most services, adopting DHI is as simple as changing the FROM line. Teams building on a secure foundation now want the same assurance for the open source their applications install. That open source is a different layer of the supply chain, where thousands of upstream projects are pulled in at build time by pip, npm and Maven, and by coding agents as well. Docker is committed to one standard for trusted content across everything teams build on. A new partnership with ActiveState , the company that has been securing open source since 1997, extends that standard to the packages themselves. Together, we give teams the same assurance on both layers, from the hardened images Docker maintains to the packages developers and their agents install on them. Once configured, the integration allows developers and AI coding assistants to continue using familiar package managers and development workflows, while approved dependencies are sourced through governed repositories rather than directly from public registries. A hardened foundation removes a class of security work before code is written

Most applications still start from a large, generic base image, and the cost of that choice keeps growing. A large image increases the attack surface and accumulates stale dependencies, and the CVEs it generates land on developers long after the image was chosen. By removing unnecessary packages, rebuilding components from source and continuously maintaining the image, Docker Hardened Images reduce the vulnerabilities inherited from the container foundation. Images can achieve near-zero known CVEs, which means less remediation work and less scanner noise before application code is introduced. The hardening and patching are handled once in the foundation, for every service that builds on it. Key takeaways

When the TeamPCP campaign weaponized a widely trusted security scanner in March, Docker Hardened Images were not affected. DHI’s controlled build pipeline and dependency cooldown periods helped prevent compromised upstream artifacts from entering the image build process during the attack window. Without trusted content on both layers, your team inherits the risk

Above the base image sit the dependencies an application brings with it. DHI secures the operating system packages and the language runtime that ship in the image. The application’s own libraries are pulled in at build time by its package managers from public registries, where trust is assumed and seldom verified. That layer needs what the image now has, a source that admits only the versions a team has approved and stands behind the fix when one of them needs it. Coding agents now pull those packages too. As Mark Lechner, CISO wrote in April , a compromised dependency pulled by an agent has the same blast radius as a compromised developer machine. This year’s supply chain incidents have followed one pattern. As Lechner documented, attackers steal developer credentials, use them to poison trusted packages, and the compromised packages steal more credentials. The axios compromise earlier this year put two backdoored versions of a library downloaded 83 million times a week into circulation for about three hours. Most of these attacks burn out within hours…