Docker + ActiveState Extending Secure Defaults to the Packages Developers Install
Docker · 软件开发
Trusted content is the foundation security-conscious organizations expect all builds to start from. Docker has made that possible for everyone by providing the foundation free. Docker Hardened Images (DHI) are open source under Apache 2.0, with a catalog of 4,000+ minimal images (and growing) built from source and continuously maintained by Docker. The catalog also carries customizable Helm charts and over 65,000 hardened system packages. For most services, adopting DHI is as simple as changing the FROM line. Teams building on a secure foundation now want the same assurance for the open source their applications install. That open source is a different layer of the supply chain, where thousands of upstream projects are pulled in at build time by pip, npm and Maven, and by coding agents as well. Docker is committed to one standard for trusted content across everything teams build on. A new partnership with ActiveState , the company that has been securing open source since 1997, extends that standard to the packages themselves. Together, we give teams the same assurance on both layers, from the hardened images Docker maintains to the packages developers and their agents install on them. Once configured, the integration allows developers and AI coding assistants to continue using familiar package managers and development workflows, while approved dependencies are sourced through governed repositories rather than directly from public registries. A hardened foundation removes a class of security work before code is written Most applications still start from a large, generic base image, and the cost of that choice keeps growing. A large image increases the attack surface and accumulates stale dependencies, and the CVEs it generates land on developers long after the image was chosen. By removing unnecessary packages, rebuilding components from source and continuously maintaining the image, Docker Hardened Images reduce the vulnerabilities inherited from the container found