Even security teams that have invested in a hardened base image often can’t say what’s running on top of it. In a recent survey of 250 North American DevSecOps leaders, 91% named visibility into container components as their single biggest blind spot. Not the base image, but everything layered onto it. And 90% said their teams still run lightly modified public images with little to no hardening.
That gap is getting harder to ignore. AI coding assistants are adding dependencies faster than teams can review them. Vulnerability databases can no longer keep pace with the volume of submissions. New regulatory requirements, including the EU Cyber Resilience Act, are also increasing expectations around vulnerability handling, remediation, and software supply chain transparency.
Docker Hardened Images meet ActiveState’s Curated Catalog
Docker, Inc. and ActiveState today announced a reselling partnership that brings Docker Hardened Images (DHI) together with ActiveState’s curated open source packages, giving enterprises a more consistent way to secure both the container base and the software dependencies layered on top.
DHI provides secure-by-default, minimal container images, with 4,000+ images built from source, near-zero CVEs, signed SBOMs, and SLSA Build Level 3 provenance. The catalog is free and open source under Apache 2.0, with production tiers backed by a 7-day SLA for critical and high-severity CVEs.
ActiveState extends that trusted foundation to the open source dependencies developers add on top. Its curated components span more than a dozen language ecosystems, including Python, JavaScript, Java, Perl, Tcl, and Ruby. Components are built from source, continuously maintained and remediated against contractual SLAs, and delivered through the package managers, pipelines, IDEs, and AI coding tools development teams already use.
Trust across the software stack
- A more consistent approach to trusted open source: Pair a hardened container base with curated open source dependencies, reducing the need to source and manage each layer separately
- Verifiable provenance across the stack: With both Docker and ActiveState building from source to SLSA Build Level 3 standards, teams get a more consistent evidence trail across the software supply chain
- Fewer vulnerabilities, without slowing teams down : DHI delivers near-zero CVEs, 95% smaller attack surface, 7-day SLA on critical/high CVEs. ActiveState provides 95% fewer CVEs and 90% faster remediation than community open source, backed by a 5-day SLA on critical vulnerabilities.
Available Now
The Docker and ActiveState reselling partnership is available now. Explore the partnership.
