Score, a CNCF Sandbox project, recently joined the Docker‑Sponsored Open Source (DSOS) Program. The move shifted its image registry to Docker Hub, added Docker Scout scans to every pull request, and replaced its previous base images with Docker Hardened Images. For engineers responsible for CI/CD, supply‑chain security, and runtime hardening, the shift provides concrete tooling and data that can be incorporated directly into existing pipelines.
Registry migration and visibility
Before the program, Score’s images – the CLIs for score-compose, score-k8s, score-helm, score-radius and the demo sample-score-app – lived in GitHub Container Registry. After joining DSOS, all images are published on Docker Hub. The change improves discoverability and adds a verified badge, while Docker Hub’s usage analytics give maintainers a view of how often each image is pulled.
Docker Scout integration in CI
Score already ran the OpenSSF Scorecard, but lacked a dedicated image‑level scanner. By enabling Docker Scout, the project now runs a comparison on every PR. The GitHub Action uses the docker/scout-action to compare the PR build against the main branch, posting a comment that lists size differences, added or removed packages, newly introduced CVEs, and policy compliance (non‑root, no critical CVEs, no AGPL‑v3 packages). The console aggregates CVE, package, and base‑image data across all Score images, giving a single pane of glass for supply‑chain health.
- name: Docker Scout Comparison
uses: docker/scout-action@v1
with:
command: compare
image: local://score-compose:pr-${{ github.event.number }}
to: local://score-compose:main
write-comment: true
github-token: ${{ secrets.GITHUB_TOKEN }}
organization: ${{ secrets.DOCKER_HUB_ORG }}
Adoption of Docker Hardened Images
Docker Hardened Images are minimal, security‑focused base images released under Apache 2.0. They provide a reduced attack surface, default non‑root execution, SBOMs, and SLSA Level 3 provenance. Score’s migration required only minor Dockerfile edits. For example, the score-radius CLI switched from golang:alpine to dhi.io/golang, shaving 0.3 MB off the final image without changing package count or CVE count. The NodeJS demo app moved from a standard Alpine‑based Node image to dhi.io/node, removing 22 packages (including the package manager and shell) and eliminating two CVEs. The changes illustrate that adopting Hardened Images can be low‑effort while delivering measurable security benefits.
Docker GitHub Builder for reproducible releases
Although not a DSOS requirement, Score also adopted the docker/github-builder reusable workflow. This workflow centralises the BuildKit environment, supports multi‑platform builds, and records signed SLSA provenance linking each image back to the source commit and builder identity. The approach reduces the operational burden of maintaining custom build scripts and aligns image releases with emerging supply‑chain provenance standards.
Related CloudNinjas coverage: hands-on guides.
What This Means For Practitioners
Engineers should evaluate whether their projects can benefit from moving to Docker Hub for better discoverability and analytics, and from adding Docker Scout to PR pipelines for automated CVE drift detection. Switching to Docker Hardened Images is often a small Dockerfile change that yields a smaller attack surface and built‑in provenance. Finally, using the Docker GitHub Builder can simplify multi‑arch builds and provide verifiable provenance without extra tooling. The combination of these steps creates a tighter feedback loop around supply‑chain risk, which is directly actionable for CI/CD, SRE, and security teams.