Docker Makes 1,000 Hardened Images Free and Open Source

Docker has announced that it has made more than 1,000 hardened images free and open source for developers, building on the May release of Docker Hardened Images (DHI), a catalog designed to strengthen enterprise supply chain security. The images are continuously scanned and updated to minimise exploitable CVEs, run as non-root by default, and are designed to be minimal to reduce the attack surface while meeting compliance standards across multiple distributions.

The DHI catalog was created in partnership with Cloudsmith, GitLab, Grype, JFrog, Microsoft, Neo4j, NGINX, Sonatype, Sysdig and Wiz, and, when first launched, was behind a paywall as a commercial offering. According to Docker, for transparency, every image comes with proof of authenticity, an SBOM, CVE data and SLSA Build Level 3 provenance, while the basic DHI remains free and commercial versions continue to be offered for enterprises with stricter security or regulatory needs. This openness follows a broader trend of bolstering supply chain security as container environments become increasingly central to development workflows.