Introduction
When we launched Docker Hardened Images (DHI) just over a year ago, we set out to challenge industry norms. Now, with over 500,000 daily pulls and 25,000+ continuously patched OS-level artifacts flowing through a SLSA Build Level 3 pipeline, the numbers speak for themselves. But the real story isn't the scale—it's the deliberate choices we made. We chose the harder path: offering hardened images for free, supporting multiple distributions, building every package from source, and shipping extensive signed attestations. This guide will walk you through how you can adopt the same approach to fortify your container security, step by step.
What You Need
- Docker (or any OCI-compatible container runtime) installed and configured
- A container registry (e.g., Docker Hub, GitHub Container Registry, or your own private registry)
- Basic knowledge of container images and common vulnerabilities (CVEs)
- Access to a hardened image catalog (like the free DHI Community tier, available under Apache 2.0)
- A CI/CD pipeline or integration tool for automated updates
- Familiarity with SBOMs and attestations (helpful but not required)
Step 1: Understand the Harder Path Philosophy
Before diving into technical steps, internalize why choosing a harder path matters. The container security landscape is full of shortcuts: proprietary "distroless" OSs, delayed patching, and incomplete SBOMs. These shortcuts trade long-term resilience for short-term convenience. The harder path means:
- Open source licensing (like Apache 2.0) so you can audit and modify.
- Multi-distro support (Debian, Alpine, etc.) so you don’t have to migrate to a vendor-controlled OS.
- Building every system package from source for the distributions you already run.
- Comprehensive signed attestations for independent verifiability.
These principles drove the creation of DHI and can guide your own evaluation of any hardened image provider.
Step 2: Evaluate Your Current Container Security Baseline
Audit your existing images and workflows. Ask yourself:
- How frequently are your base images patched for CVEs?
- Is the patching reactive (after disclosure) or proactive (continuous)?
- Do you have complete SBOMs for every image?
- Are your images built and signed in a SLSA-compliant pipeline?
- Do you rely on a single distribution or vendor?
Many organizations find that industry-standard patching cycles (e.g., monthly) leave critical vulnerabilities exposed for weeks. The harder path demands continuous patching—every system package updated as soon as fixes are available. Look for providers that run millions of builds regularly, as DHI does, to ensure freshness.
Step 3: Select a Hardened Image Provider
Not all hardened images are created equal. Use these criteria to choose:
- Multi-distro catalog: Avoid providers that lock you into a proprietary OS. Look for support for Debian, Alpine, and other distributions you already use.
- Open source and free tier: Security shouldn’t be a premium feature. Choose a provider with a free community tier (like DHI under Apache 2.0).
- Build-level attestations: Check for SLSA Build Level 3 or higher, with signed attestations for provenance and reproducibility.
- Continuous patching pipeline: Ensure every package is rebuilt from source using the latest upstream patches, not just repackaged binaries.
- Extensive catalog: Over 2,000+ images, plus MCP servers, Helm charts, and ELS images, indicates maturity.
Step 4: Migrate Your Workloads Drop-In
One major advantage of multi-distro hardened images: you don’t need to rewrite your Dockerfiles or retest your applications. Simply replace your base image tag with the hardened equivalent. For example:
FROM debian:bullseye-slim becomes FROM myregistry.io/hardened/debian:bullseye.
Because the hardened images use the same OS, you avoid the “migration tax” imposed by distroless alternatives. Test in a development environment first, then promote to staging and production. The drop-in approach minimizes risk while instantly raising your security baseline.
Step 5: Implement Continuous Verification
Once your images are pulled from a hardened catalog, verify them every time you deploy:
- Check signatures using cosign or similar tools to confirm authenticity.
- Verify attestations (e.g., SLSA provenance) to ensure the image was built in a trustworthy pipeline.
- Scan the image with your own security tools to confirm no new vulnerabilities have slipped in.
The hardest path includes making verifiability a first-class feature. DHI ships a huge range of signed attestations with every image, so you can independently confirm the build process meets your standards.
Step 6: Maintain and Stay Updated
Security is not a one-time fix. With a hardened image pipeline that continuously patches all artifacts (across CVEs, distros, and versions), you can rely on automated updates. Integrate your CI/CD to pull fresh base images on a schedule (e.g., daily or weekly). Monitor the provider’s advisory feed for any critical updates. The DHI pipeline runs over a million builds regularly, so staying current is as simple as re-pulling the latest tag.
Tips for Long-Term Success
- Start with the free tier. The DHI Community edition under Apache 2.0 is a no-risk way to test the hardened approach. If it meets your needs, consider the paid plan for wider coverage.
- Don’t fear the learning curve. The concepts of SLSA, attestations, and build-from-source may seem complex, but they pay dividends in auditability and trust.
- Engage with the community. Open-source projects thrive on collaboration. Share your feedback and contribute improvements.
- Look beyond base images. Extend the hardened philosophy to all artifacts you produce: Helm charts, MCP servers, and extended-life support (ELS) images.
- Measure your impact. Track daily pulls, patched CVEs, and build frequency over time. Over 25k continuously patched artifacts is a good benchmark.
By deliberately choosing the harder path—open, multi-distro, verifiable, and continuously updated—you not only protect your own deployments but also raise the security baseline of the entire ecosystem. A year from now, you’ll be glad you did.