TechPrufer
Get started
Docker
Docker logoDocker · Feature trail

Container Image Security and Supply Chain Hardening

1 post · Nov 2026

What this trail covers

This feature thread tracks Docker's initiatives and tooling to enhance the security and integrity of container images throughout their lifecycle. It encompasses the adoption of tools like Docker Scout for vulnerability scanning and policy enforcement, the use of Docker Hardened Images (DHI) for minimal and secure base images with SBOMs and SLSA provenance, and the integration of secure CI/CD build pipelines like the Docker GitHub Builder which leverages OIDC for signing and provenance. The goal is to provide open-source projects and developers with a robust, transparent, and secure foundation for building and distributing containerized applications.

All Docker trails
  1. How CNCF Score Improved Container Security | DockerThis post details how the CNCF Score project leveraged the Docker-Sponsored Open Source (DSOS) Program to significantly improve its container image security. Key contributions include: migrating to Docker Hub for increased visibility and trust, integrating Docker Scout for automated CVE detection and policy compliance checks in pull requests and on the registry, adopting Docker Hardened Images (DHI) to reduce attack surface and inherit security benefits (minimal components, non-root execution, SBOMs, SLSA L3), and implementing the `docker/github-builder` reusable workflow for secure, OIDC-authenticated CI/CD builds with signed SLSA provenance and SBOM attestations. The post quantifies improvements such as reduced CVE counts and image sizes after adopting DHI.