As supply-chain attacks escalate—with AI generating more of the code you ship—Docker is reinforcing its image security and compliance story. The newest updates, detailed in a recent blog post, focus on Docker Extended Lifecycle Support (ELS) for end-of-life software like MinIO, plus a push for source-built software and ubiquitous policy enforcement.
Here’s what changed:
- Extended Lifecycle Support (ELS): For projects like MinIO that have reached end of life, Docker ELS ensures you continue receiving security patches and compliance updates beyond upstream's support window. This is critical for audit-ready deployments where you can't simply upgrade major versions.
- More software built from source: Docker's latest updates bring more software built from source into your images. This improves transparency and reduces the risk of tampered binaries, a key defense against supply-chain attacks.
- Guarantees through customized images: ELS guarantees carry through your customized images, so even if you base off an official image and modify it, you retain the same level of security coverage and patching assurance.
- Policy enforcement on every machine: Docker is moving policy enforcement onto every developer machine. This means your
docker pullanddocker buildcommands will increasingly be checked against your organization's security policies locally, catching issues before they reach CI/CD pipelines.
For developers, this shift is significant. ELS offers a lifeline when you're stuck on an unmaintained dependency due to legacy constraints. The source-built emphasis means you can trace your base images to their origins, simplifying audit reports. And local policy enforcement (likely via tools like docker scan or docker build --check) helps you stay compliant without slowing down the inner loop.
Make sure to review your base images and check Docker's documentation on ELS and Docker Scout to see how these updates apply to your current workflow. Staying patched is now less about heroics and more about leveraging Docker's extended support and proactive scanning.
Source: https://www.docker.com/blog/minio-end-of-life-how-to-stay-patched-and-audit-ready-with-docker-els/