Docker Open Sources Production-Ready Hardened Images for Free
Docker has announced a change in its container security approach by making Docker Hardened Images (DHI) available at no cost to developers.
Docker has announced a change in its container security approach by making Docker Hardened Images (DHI) available at no cost to developers.
Previously a commercial product, DHI offers secure, minimal, and production-ready container images . These images are now released under an Apache 2.0 license, aiming to address the increasing incidents of software supply chain attacks , which resulted in significant financial damages in 2025.
With over 20 billion monthly downloads on Docker Hub , Docker aims to provide a secure starting point for developers worldwide, irrespective of their budget constraints.
DHI is open source and compatible with widely used foundations like Alpine and Debian , allowing developers to adopt these secure images without altering existing Dockerfiles or workflows.
Docker's "hardened" images maintain transparency and include:
Full Transparency: Complete Software Bill of Materials (SBOM) for each image Provenance: Verification using SLSA Build Level 3 Honest Reporting: Comprehensive CVE status without concealing vulnerabilities Reduced Attack Surface: Images reduced by up to 95% to minimize security risks
Docker has announced a change in its container security approach by making Docker Hardened Images (DHI) available at no cost to developers.
While the base DHI images are free, Docker continues to offer DHI Enterprise for organizations requiring stringent regulatory compliance. This commercial tier emphasizes service-level agreements (SLAs) rather than restricting access to security technology. The enterprise program extends beyond basic OS images.
Feature Docker Hardened Images (Free) DHI Enterprise (Paid)
Availability Open Source (Apache 2.0) Commercial License
Base OS Alpine, Debian Alpine, Debian + Custom
Patching Speed Standard Release Cycle <7 Day SLA for Critical CVEs
Compliance Standard Security FIPS, FedRAMP, STIG
Lifecycle Standard Support Extended Lifecycle Support (ELS)
The release also incorporates Hardened Helm Charts for Kubernetes and trusted versions of the Model Context Protocol ( MCP ) servers for tools like MongoDB, Grafana, and GitHub.
Based on reporting by Cyber Security News.
