Live
GitHub secret scanning adds SpaceX partner and refines false‑positive filtersOpen‑Source Nemotron LLMs: What Engineers Need to Know for Self‑Hosted DeploymentRunning Stateful AI Agents on GKE with Agent SubstrateDocker Hardened Images now pull curated packages from ActiveStateBigQuery’s AI.AGG brings native semantic aggregation to petabyte‑scale queriesFull‑Stack Memory Codesign Reduces AI Inference Footprint and Boosts ThroughputDocusign Model Context Protocol hits GA: practical impact on AI‑agent integration and securityA Kubernetes‑Native Pattern for Open‑Weight Model Serving, Fine‑Tuning, and Secure Agent ExecutionGitHub secret scanning adds SpaceX partner and refines false‑positive filtersOpen‑Source Nemotron LLMs: What Engineers Need to Know for Self‑Hosted DeploymentRunning Stateful AI Agents on GKE with Agent SubstrateDocker Hardened Images now pull curated packages from ActiveStateBigQuery’s AI.AGG brings native semantic aggregation to petabyte‑scale queriesFull‑Stack Memory Codesign Reduces AI Inference Footprint and Boosts ThroughputDocusign Model Context Protocol hits GA: practical impact on AI‑agent integration and securityA Kubernetes‑Native Pattern for Open‑Weight Model Serving, Fine‑Tuning, and Secure Agent Execution
Docker

Docker Hardened Images now pull curated packages from ActiveState

Ninja·November 5, 2026·2 min read·via Docker Blog
AI SummaryPowered by AI

Docker has added a built‑in integration with ActiveState’s Curated Catalog, letting teams source OS packages and language dependencies from a trusted repository instead of public registries. This extends the security guarantees of Docker Hardened Images to the third‑party libraries that applications install, reducing supply‑chain risk for engineers and operators.

Docker’s Hardened Images (DHI) now include a direct link to ActiveState’s Curated Catalog, creating a single source of trusted content for both the base container and the packages developers add during builds. The change means you can keep using familiar tools like pip or npm while the actual binaries are fetched from a private, policy‑governed repository that provides provenance and remediation SLAs.

What Changed: Integrated Curated Package Repository

DHI continues to supply minimal, source‑built images with signed SBOMs and SLSA Level 3 build provenance. The new partnership adds a second layer: ActiveState compiles every open‑source component from its original source in a SLSA Level 3 environment, publishes a full SBOM, and stores the result in the Curated Catalog. When a DHI image is used, the package manager can be pointed at this catalog, replacing the default public registry lookup.

Impact on Build Pipelines and AI Coding Assistants

Build scripts and AI‑driven coding assistants do not need to change their command syntax. The integration simply redirects the resolution step to the curated source, so pip install or npm install still works as before. The catalog only contains versions that a security team has approved, and ActiveState automatically rebuilds components when upstream fixes are released—typically within five business days for critical CVEs and ten days for high CVEs. This gives teams a predictable remediation window for both the OS layer and the language libraries.

Operational and Security Implications

  • Reduced attack surface. By eliminating unnecessary OS packages and ensuring that only vetted language dependencies are used, the combined stack can approach near‑zero known CVEs before any application code is added.
  • Consistent evidence trail. Both the image and each package carry signed SBOMs and SLSA provenance, allowing security teams to trace exactly what is running and how it was built.
  • SLAs for vulnerability remediation. DHI offers a seven‑day SLA on critical and high CVEs for its paid tiers; the Curated Catalog adds its own five‑day and ten‑day windows for critical and high CVEs respectively.
  • Compatibility with existing artifact stores. Artifact repositories such as Artifactory or Nexus can be configured to proxy the Curated Catalog, preserving existing CI/CD integration points.
  • Continued use of lockfiles and cooldown periods. The integration does not replace best practices like pinning digests or applying cooldown windows; it simply provides a trusted source for the versions that are pinned.

Related CloudNinjas coverage: hands-on guides.

What This Means For Practitioners

Adopting the combined DHI and Curated Catalog approach requires updating your image FROM line to a hardened image and configuring your package manager to point at the catalog endpoint. Evaluate whether your CI pipelines already enforce lockfiles or cooldown periods, and ensure those controls remain in place. Verify that your artifact repository can proxy the catalog to avoid breaking existing workflows. Finally, monitor the SBOMs and provenance data that Docker and ActiveState publish to confirm that the expected versions are being used and that remediation SLAs are being met.

Tags: #docker#activestate#supply-chain#security#devops
Originally published atDocker Blog
Related Articles
Docker

Choosing Code Placement in Docker Sandbox: Implications for AI and Platform Engineers

4 min read
Docker

Applying AI Agent Governance: Docker’s Blueprint Alliance and Agent Baseline in Practice

4 min read
Docker

AI Governance Gets a Runtime Layer: Docker’s Navigator Partner Program for Engineers

4 min read