Hardened Images | Docker

Secure, minimal container images for every team, free with enterprise features, if needed.
Swap the base image and get instant security gains.
You can migrate to and from with freedom and without surprises. Pay when you need stronger SLAs, compliance, or to leverage our build service.
Drop-in replacements that require minimal changes. Our event-driven build system keeps images continuously updated, and secure customization allows you to tailor hardened images without breaking provenance.
Every DHI image is built with system packages that Docker builds, patches, and maintains directly from upstream source.
Signed SBOMs and SLSA Level 3 provenance, with complete CVE data.
When upstream stops, your protection continues. Up to 5 extra years of hardened patching, SBOMs and provenance.
“For the first time, I don’t have to worry about what’s hiding in our base images. That mental overhead is gone, and we can finally focus on the security challenges that are unique to Attentive.”
Principal Security Engineer at Attentive
Security and compliance for end-of-life software. Requires DHI Enterprise.
“Security shouldn’t be a premium feature. By making hardened images free, Docker is letting every developer—not just big enterprises—start with a safer foundation. We love seeing tools that reduce noise and toil, and we’re ready to run these secure workloads on Google Cloud from day one.”
Senior Director of Product, Developer Experiences
“At MongoDB, we believe open source plays a central role in how modern software is built, enabling flexibility, choice, and developer productivity. That’s why we’re excited about free Docker Hardened Images for MongoDB. These images provide trusted, ready-to-deploy building blocks on proven Linux foundations such as Alpine and Debian, and with an Apache 2.0 license, they remain fully open source and free for anyone to use. With Docker Hub’s global reach and MongoDB’s commitment to reliability and safety, we are making it easier to build with confidence on a secure and open foundation for the future.”
Chief Technology Officer, MongoDB
“Docker’s move to make its hardened images freely available under Apache 2.0 underscores its strong commitment to the open source ecosystem. Many CNCF projects can already be found in the DHI catalog, and giving the broader community access to secure, well-maintained building blocks helps us strengthen the software supply chain together. It’s exciting to see Docker continue to invest in open collaboration and secure container infrastructure.”
Executive Director, Cloud Native Computing Foundation
Docker Hardened Images
Requires workflow changes
Minimal, near-zero CVEs, SLSA Build L3
Partial visibility (suppressed CVEs, proprietary scoring)
ELS provides up to 5 years
Typically ends up to 6 months
Hear how how containers shaped the trust model we rely on today at Docker, and what AI-driven systems mean for the next chapter of software supply chain security.
Docker Hardened Images are now free and open source under Apache 2.0.
Docker engineers break down the five pillars of supply chain security and why minimal, non-root images are a safer default.
Docker Hardened Images are near-zero CVE, secure-by-default, minimal container images designed to serve as a trusted, verifiable upstream for modern software supply chains. Each image is continuously rebuilt from source, reducing attack surface while patching known CVEs as fixes become available rather than on a manual schedule.
The catalog includes thousands of production-ready images spanning runtimes, frameworks, databases, and infrastructure components, with open-source free and commercial tiers available.
Yes. The full Docker Hardened Images catalog is free and open source under the Apache 2.0 license. Any developer can pull and use hardened images from Docker Hub at no cost, with no usage restrictions or paywalled catalog access. Because the images are open source and built on standard Alpine and Debian foundations, teams retain full portability with no vendor lock-in.
Commercial tiers (DHI Select and DHI Enterprise) are available for organizations that need assurances such as SLA-backed remediation, compliance-ready image variants, and image customization.
Docker Hardened Images are available in three tiers, each building on the one before it.
Docker Hardened Images support both Alpine and Debian, so teams can choose the distribution that matches their existing environment without switching package ecosystems or retraining on unfamiliar tooling.
This matters a lot, because your choice of Linux distribution affects everything downstream: library compatibility, shell scripting, debugging tools, and package management. Docker Hardened Images preserve those foundations rather than replacing them.
Docker Hardened Images take a fundamentally different approach by hardening the distributions developers already use rather than requiring migration to a proprietary or unfamiliar operating system. Teams can adopt them as a drop-in replacement with minimal workflow changes, while other providers may necessitate retooling of CI/CD pipelines, debugging workflows, and dependency management.
The Docker Hardened Images catalog is also free and open under Apache 2.0 with no paywalled image versions or usage restrictions. Where other providers may significantly limit the number of images available under free access, or require paid subscriptions for production use, the entire hardened catalog is available to everyone – including for production uses.
You could, but Docker Hardened Images replace the operational burden of maintaining internal hardening pipelines with a continuously maintained, verifiable supply of production-ready images. Teams that build their own hardened images typically invest significant engineering time in patching, rebuilding, testing, and maintaining SBOMs and provenance for every image in their portfolio.
With Docker Hardened Images, that work is handled by our automated build system, which