Docker and ActiveState announced a partnership that merges Docker Hardened Images (DHI) with ActiveState’s Curated Catalog. The joint offering replaces the previous practice of stitching together public base images and ad‑hoc dependencies, giving teams a unified, source‑built stack that is signed, SLSA Level 3, and covered by SLA‑backed vulnerability remediation.
Unified provenance for base images and dependencies
DHI supplies more than 4,000 minimal container images built from source, each accompanied by a signed Software Bill of Materials (SBOM) and SLSA Build Level 3 provenance. ActiveState’s catalog extends the same source‑build discipline to over a dozen language ecosystems—including Python, JavaScript, Java, Perl, Tcl, and Ruby—delivering curated packages through the same package managers and CI pipelines that developers already use. The shared provenance creates a continuous evidence trail across the entire stack, simplifying compliance with emerging regulations such as the EU Cyber Resilience Act.
Operational impact on CI/CD and AI‑assisted development
Survey data cited in the announcement shows that 91 % of DevSecOps leaders view visibility into container components as their biggest blind spot, and AI coding assistants are accelerating dependency churn beyond manual review capacity. By pulling curated components directly into pipelines, IDEs, and AI‑assisted tools, teams can reduce the manual effort required to vet each new library. The partnership also eliminates the need to maintain separate hardening processes for the base image and the layered packages, streamlining build scripts and reducing the risk of mismatched security policies.
Security posture and SLA guarantees
DHI advertises near‑zero CVEs, a 95 % smaller attack surface, and a 7‑day SLA for remediation of critical or high‑severity CVEs. ActiveState’s catalog claims 95 % fewer CVEs and 90 % faster remediation than community‑maintained equivalents, backed by a 5‑day SLA for critical vulnerabilities. These guarantees translate into predictable remediation windows and a reduced likelihood of production‑time exposure, addressing the 90 % of teams that still run lightly modified public images with little hardening.
Related CloudNinjas coverage: security.
What This Means For Practitioners
Practitioners should evaluate replacing existing public base images with DHI and adopting the Curated Catalog for language‑specific dependencies. Key actions include:
- Integrate the signed SBOMs into existing vulnerability scanning tools to close the visibility gap identified by the survey.
- Update CI/CD pipelines to pull packages from the curated catalog rather than ad‑hoc public registries.
- Map the 7‑day and 5‑day SLA windows to internal incident‑response timelines to ensure compliance with regulatory expectations.
- Monitor the provenance metadata for SLSA Level 3 compliance as part of supply‑chain attestations.
By consolidating the base image and dependency layers under a single, source‑built provenance model, teams can reduce blind spots, accelerate remediation, and align more closely with upcoming supply‑chain regulations.