The combined offering from Docker and ActiveState aims to provide organizations with a unified method for securing both the foundational container image and the ancillary software components added to it, through a new reselling agreement.
This integration pairs Docker Hardened Images (DHI) with ActiveState’s selection of vetted open-source packages, presenting enterprises with a more cohesive security posture for their container deployments.
DHI itself furnishes container images that are secure by default and minimal, comprising over 4,000 images built directly from their source code. These images feature near-zero known vulnerabilities (CVEs), include signed Software Bill of Materials (SBOMs), and possess SLSA Build Level 3 provenance. Furthermore, this catalog is available without charge and under the Apache 2.0 license, with production-level support guaranteeing a 7-day Service Level Agreement (SLA) for addressing critical and high-severity CVEs.
ActiveState enhances this trusted foundation by extending its vetting to the open-source dependencies that developers integrate. Its collection of components covers over a dozen programming language environments, including Python, JavaScript, Java, Perl, Tcl, and Ruby. These chosen components undergo source-based construction, receive ongoing maintenance, and are patched according to contractual SLAs, being accessible via the package managers, pipelines, Integrated Development Environments (IDEs), and artificial intelligence coding tools that development teams frequently employ.
This combined approach offers several distinct advantages for operators. Teams can establish a more uniform strategy for trusting open-source software by matching a hardened container base with curated open-source dependencies, thereby lessening the necessity of independently sourcing and administering each constituent layer. Moreover, because both Docker and ActiveState adhere to SLSA Build Level 3 standards through source building, organizations gain a more consistent audit trail throughout the entire software supply chain. Operationally, this translates to fewer vulnerabilities without impeding team velocity; DHI contributes by offering near-zero CVEs, a 95% reduced attack surface, and a 7-day SLA for critical/high CVEs, while ActiveState promises 95% fewer CVEs and 90% quicker remediation times compared to community open-source alternatives, supported by a 5-day SLA for critical vulnerabilities.
This strategic alignment addresses mounting pressures in the software development lifecycle; for instance, a recent survey of 250 North American DevSecOps leaders revealed that 91% identified visibility into container components as their most significant deficiency, noting that the issue lies not with the base image but with everything placed atop it. Furthermore, 90% indicated that their teams continue to utilize public images with minimal or no hardening applied. The velocity of AI coding assistants accelerates dependency incorporation faster than teams can conduct thorough reviews, and vulnerability databases are struggling to keep pace with the sheer volume of submissions. Regulatory expectations are also intensifying, driven by new mandates such as the EU Cyber Resilience Act, which demands greater transparency regarding software supply chains, vulnerability handling, and remediation processes.
The reselling partnership between Docker and ActiveState is effective immediately.
