How CNCF Score Improved Container Security | Docker

This post details how the CNCF Score project leveraged the Docker-Sponsored Open Source (DSOS) Program to significantly improve its container image security. Key contributions include: migrating to Docker Hub for increased visibility and trust, integrating Docker Scout for automated CVE detection and policy compliance checks in pull requests and on the registry, adopting Docker Hardened Images (DHI) to reduce attack surface and inherit security benefits (minimal components, non-root execution, SBOMs, SLSA L3), and implementing the `docker/github-builder` reusable workflow for secure, OIDC-authenticated CI/CD builds with signed SLSA provenance and SBOM attestations. The post quantifies improvements such as reduced CVE counts and image sizes after adopting DHI.