Docker Hardened Images
lastmod 2025-12-21created 2025-12-211 edits
Docker for a safer container ecosystem
About
- Docker Hardened Images (DHI) are security-hardened, minimal production container images, released under the Apache 2.0 license so that every developer can use them for free
- DHI is built on Alpine and Debian, so it integrates easily into existing workflows, and provides a trustworthy security foundation through SBOM, SLSA Build Level 3, and transparent CVE disclosure
- The enterprise offering DHI Enterprise includes a CVE patch SLA of under 7 days, images for regulated industries (FIPS, STIG), and customized build infrastructure, while Extended Lifecycle Support (ELS) provides up to 5 years of additional security support
- Major companies such as Adobe, Qualcomm, Google, MongoDB, and Anaconda have adopted DHI or joined as partners, taking part in strengthening software supply chain security
- With this move, Docker establishes an industry standard under which every developer and organization can start from a secure-by-default container environment