ActiveState Allies with Docker to Harden Software Artifacts
The partnership matters less as a procurement shortcut than as a shift in where container-security work gets done. For platform teams, hardened base images and remediated language packages are only useful if they become part of a controlled software-factory path: approved registries, policy-enforced CI/CD, SBOM capture, signature verification and automated redeployment when upstream fixes land. Otherwise, organizations risk buying better artifacts while still letting developers pull unmanaged images and packages into builds.
The practical architecture question is how to join image provenance and application dependency provenance into one deployable trust chain. Many enterprises already scan images at registry or cluster admission, but far fewer can answer whether the Python, Java or other runtime packages added during build were rebuilt from trusted sources and patched on a predictable SLA. That gap is where most implementation friction will sit, especially for teams running mixed-language services across multiple Kubernetes clusters and cloud registries.
There is also an operational trade-off. Outsourcing artifact hardening can reduce internal maintenance burden, but it creates a dependency on supplier patch velocity, compatibility testing and rebuild transparency. Security leaders should treat this as a resilience question, not just a vulnerability-count question: how quickly can a supplier publish fixes, how easily can teams promote those artifacts through test and production, and what happens when a hardened dependency update breaks application behavior?
For practitioners, the next step is not simply adopting curated artifacts; it is measuring mean time to ingest upstream fixes, enforcing trusted sources in pipelines and validating that emergency rebuild processes are faster than the exploit window.
TL;DR — Key Takeaways
- ActiveState and Docker are partnering to secure enterprise containers. The companies will resell each other’s offerings, combining Docker’s hardened base images with ActiveState’s remediated open source libraries.
- Container security requires protection across every layer. Hardened base images help reduce risk, but application dependencies also need ongoing monitoring, patching and verification.
- Adoption still trails security priorities. An ActiveState survey found 90% of surveyed DevSecOps leaders said their teams run lightly modified public images with little to no hardening, despite 98% ranking hardened images a high priority.
ActiveState and Docker, Inc. today revealed they will both resell the hardened libraries and images that each company curates.
The overall goal is to make it simpler for application development teams to source both hardened container images and the libraries they run on that are certified using Level 3 of the Supply-chain Levels for Software Artifacts (SLSA) framework.
ActiveState CEO Abby Kearns said the alliance creates an ecosystem around a set of hardened open source software artifacts to better secure software supply chains. Docker has also already curated more than 4,000 hardened images while ActiveState provides access to a large number of libraries spanning 10 programming languages. The company also provides a service level agreement (SLA) through which it makes a hardened library available within five days of an upstream fix to a vulnerability in an open source project being made.
It’s not clear how quickly organizations are moving to secure their software supply chains, but in the artificial intelligence (AI) era, the rate at which cybercriminals are able to reverse engineer a vulnerability to create an exploit has been reduced to a matter of hours. On top of that, malicious actors are increasingly leveraging AI to now launch cyberattacks at machine speed.
In the absence of a repository that makes it simpler for developers to access hardened images and libraries, it’s become much more likely that a vulnerability discovered in a production environment will be exploited.
Unfortunately, not enough organizations are proactively moving to mitigate those threats to their software supply chains, said Kearns. A recent ActiveState survey finds 91% of application development teams have limited visibility into container components, with 90% still running lightly modified public images with little to no hardening.Â
It will probably require more or more catastrophic events involving a breach of a known vulnerability before software engineering teams are directed to spend more time on securing existing applications versus continuing to develop new applications or add features to existing applications, said Kearns. On the plus side, however, nearly all survey respondents (98%) identified adoption of hardened images as a high priority.Â
In the meantime, however, the amount of potentially vulnerable code being deployed in the age of AI coding is only increasing. A separate ActiveState survey finds that as organizations rely more on AI coding tools to build applications, they are simultaneously increasing the amount of open source software they are dependent on. Specifically, the survey finds 89% of respondents work for organizations that are using AI coding tools in production environments. Among those respondents, 94% are using more open source software as a result, largely because it is much more readily accessible. The challenge is that AI models are now surfacing more vulnerabilities in open source software than ever.
Mitch Ashley, vice president and practice lead for software lifecycle engineering for the Futurum Group, said thoroughly hardening images and libraries takes sustained engineering work. Teams have to track every dependency, rebuild on each upstream fix, and prove provenance. Few application teams can staff that, and the patch cycle keeps shrinking as AI cuts the time from disclosure to exploit, he added.
Deploying hardened artifacts moves that work to suppliers, but the challenge is whether ActiveState and Docker can maintain their rebuild and patch velocity ahead of the exploit window, said Ashley.
At this juncture, the concern is less about whether a vulnerability will be exploited than how to reduce the number of incidents that might occur. The more hardened images and libraries that have been deployed, the fewer the number of incidents there should ultimately be.
Frequently Asked Questions
Organizations can obtain Docker Hardened Images and ActiveState’s remediated open source components through a single vendor relationship, simplifying procurement and software supply chain security.
Applications add libraries and other dependencies on top of a base image. Those components can introduce vulnerabilities and require their own security checks and updates.
Docker provides SLSA Build Level 3 provenance, while ActiveState builds components within SLSA Level 3 infrastructure. These practices help organizations verify how software artifacts were built and protect against build tampering.
Enjoyed this article? Sign up for our newsletter to receive regular insights and stay connected.