Docker, Inc. and ActiveState today announced a reselling partnership that brings Docker Hardened Images (DHI) together with ActiveState's curated open source packages. The goal is to give enterprises a more consistent way to secure both the container base image and the software dependencies layered on top of it.
The announcement frames the problem around a gap in visibility. Even security teams that have invested in a hardened base image often can't say what is running above it. In a survey of 250 North American DevSecOps leaders, 91% named visibility into container components as their single biggest blind spot, and 90% said their teams still run lightly modified public images with little to no hardening.
- Docker Hardened Images (DHI) provide secure-by-default, minimal container images, with more than 4,000 available (the excerpt is cut off at this figure).
- ActiveState's Curated Catalog supplies vetted open source packages that sit on top of the container base.
- The partnership is structured as a reselling agreement between the two companies.
- The combined offering targets both halves of the stack: the base image and the dependencies layered on it.
The post points to several pressures making this gap harder to ignore. AI coding assistants add dependencies faster than teams can review them, and vulnerability databases can no longer keep pace with the volume of submissions. New regulatory requirements, including the EU Cyber Resilience Act, are also raising expectations around vulnerability handling, remediation, and software supply chain transparency.
For developers, the practical takeaway is that container security is no longer just a base image question. Hardening the foundation does little if the packages installed on top are unreviewed or unpatched. A pairing of minimal hardened images with a curated package catalog aims to close that blind spot by making the whole image, not just its starting layer, a known and supportable quantity, which matters as compliance requirements tighten.
Source: https://www.docker.com/blog/docker-activestate-partnership/