Docker just opened a big door. They released over 1,000 Docker Hardened Images (DHI) as open source. Each image is production-ready. Each one comes with an...
Docker Open-Source Over 1,000 Hardened Images — DHI, SBOM, SLSA, CVE, and Cryptographic Proof
Docker just opened a big door. They released over 1,000 Docker Hardened Images (DHI) as open source. Each image is production-ready. Each one comes with an SBOM, public CVE data, SLSA Build Level 3 provenance, and cryptographic proof of authenticity. This is about safer containers. It is about trust.
Why this matters
Containers run the world now. They run our services, our stores, our data pipelines. A bad image breaks more than code. It breaks trust. I learned that the hard way.
A short story
At Google, I saw a tiny vulnerability ripple across a cluster. We patched fast. At Amazon, a missing provenance file slowed a release for days. At Zulily, we chose lean images to dodge surprises. I am Ermenildo Valdez Castro, Jr. I have carried these lessons. I am Ernie Castro. I tell the truth straight. 🐳🔒
What's in each Docker Hardened Image
- SBOM (Software Bill of Materials): A full list of components. No guessing. You see what you run. This helps audits and compliance.
- Transparent public CVE data: Known vulnerabilities are listed. You can spot risk before you deploy.
- SLSA Build Level 3 provenance: Provenance shows how the image was built. Level 3 is strong. It ties the artifact to a reproducible build record.
- Cryptographic proof of authenticity: The image is signed. You can verify it didn’t change in the supply chain.
Why SBOM and provenance matter
SBOM is a map. Provenance is the story of the map. Together they stop surprise vulnerabilities and supply-chain attacks. When I worked at Microsoft, a vendor’s missing SBOM cost hours and trust. At Google, provenance stopped us from trusting a bad binary.
What this means for security
You get better visibility. You get fewer surprises. You get verifiable trust. This lowers risk in CI/CD and production. It also makes audits easier. For companies that must show compliance, this is a win.
How to use DHI in your pipeline
- Pull the hardened image from the Docker catalog.
- Inspect the SBOM. Use tools like Syft, CycloneDX, or SPDX.
- Check public CVE data. Integrate with your scanner.
- Verify SLSA provenance. Ensure your build system matches.
- Verify the cryptographic signature. Don’t run unsigned images.
Quick command ideas (conceptual)
docker pull <dhi-image>
syft packages <dhi-image> # get SBOM
cosign verify <dhi-image> # verify signature
My recommendations
- Start with base images. Replace untrusted base images first.
- Automate SBOM checks in CI.
- Fail fast on missing provenance or bad signatures.
- Treat CVE data as part of your merge criteria.
A small faith note
In my work, I learned to value truth in small things. The Bible says to build on rock, not sand. Build images on proven ground. It matters.
Conclusion
Docker’s open source of the Docker Hardened Images is practical. It raises the bar for container security. It gives teams tools they need: SBOMs, CVE transparency, SLSA provenance, and cryptographic proof. Use them. Verify everything. Trust, but verify.
About the author
I am Ermenildo Castro. I lived through big outages and small fixes. I worked at Google, Microsoft, Amazon, and Zulily. I write from Seattle. I keep my images lean. I sign what I trust. Ernie Castro. Ermenildo V Castro. 😊