CNCF Score project improved its security posture by joining the Docker-Sponsored Open Source Program

In this post, the Score maintainers share what we adopted (Docker Hub, Docker Scout, Docker Hardened Images, the Docker GitHub Builder, and OIDC connections), the results we measured, and how other open source projects, within the CNCF and beyond, can apply the same practices by default. The Opportunity In September 2025, the CNCF announced a partnership with Docker to expand infrastructure support for project maintainers through the Docker-Sponsored Open Source (DSOS) Program. The partnership gives CNCF projects access to Docker’s security scanning tools, container registry, and best-practice resources at no cost.

This aligned closely with the discussions held at the Maintainer Summit NA 2025 in Atlanta, which centered on increasing collaboration across CNCF projects and demonstrating security best practices. The Docker-Sponsored Open Source (DSOS) Program supports non-commercial open source projects with Docker tooling and infrastructure.

Earlier coverage

• Google puts new limits on AI agents that hunt threats and fix vulnerabilities Nov 5
• AI security, governance top spending priority, 40.3% of companies report Nov 5
• CISA adds exploited Apple flaw CVE-2024-27834 to KEV catalog Nov 5