Hardened Containers Look to Eliminate Common Source of Vulnerabilities

Hardened containers are being promoted as a way to eliminate common vulnerabilities in the software supply chain, after a kitchen-sink approach left many images with flaws. According to Chainguard, popular Debian-based Docker images had 280 vulnerabilities on average, while a NetRise study of 70 images found an average of 604 vulnerabilities.

Since launching in May, the Docker Hardened Images service has featured more than 1,600 images based on more than 240 projects, with Chainguard having created hardened images for more than 1,800 projects and CleanStart maintaining hardened images for more than 350 open-source projects. The aim is to reduce vulnerability counts by more than 97%, delivering near-zero known vulnerabilities or CVEs in many cases.

Proponents say the hardened images provide a secure foundation with verified SBOMs and easier compliance with standards such as FIPS. However, experts note that adoption can be slowed by teams lacking operational maturity to maintain hardened containers, and that ongoing updating and upstream fixes are essential to keep images secure.