CNCF Score project improved its security posture by joining the Docker-Sponsored Open Source Program
Docker · 软件开发
Score, a CNCF Sandbox project, recently joined the Docker-Sponsored Open Source (DSOS) Program to strengthen the security of its container images and release pipeline. In this post, the Score maintainers share what we adopted (Docker Hub, Docker Scout, Docker Hardened Images, the Docker GitHub Builder, and OIDC connections), the results we measured, and how other open source projects, within the CNCF and beyond, can apply the same practices by default. The Opportunity In September 2025, the CNCF announced a partnership with Docker to expand infrastructure support for project maintainers through the Docker-Sponsored Open Source (DSOS) Program. The partnership gives CNCF projects access to Docker’s security scanning tools, container registry, and best-practice resources at no cost. This aligned closely with the discussions held at the Maintainer Summit NA 2025 in Atlanta , which centered on increasing collaboration across CNCF projects and demonstrating security best practices. The Docker-Sponsored Open Source (DSOS) Program supports non-commercial open source projects with Docker tooling and infrastructure. Eligible projects receive: Verified Docker-Sponsored Open Source badge Removal of rate limits for developers Access to Docker Scout for software supply chain management Insights and analytics Repository logo Improved discoverability on Docker Hub Docker Hub Before: Score publishes different container images: the CLIs of score-compose , score-k8s , score-helm and score-radius ; and the sample-score-app used for demos and testing. We previously published them in the GitHub Container Registry here . After: Through the DSOS Program, we now publish these images on Docker Hub, which increases their visibility and gives the community a verified, trusted source. All the container images are now available on Docker Hub . The program also provides usage analytics that show how the community uses these images. Here is an example: Docker Scout Before: As a CNCF project, Score