Docker makes its 1,000+ hardened images free and open source

2025-12-17 · Publisher : Docker · Domain : Cloud & DevOps

On 17 December 2025, Docker opens its catalog of more than 1,000 Docker Hardened Images under the Apache 2.0 license, previously paid, and launches DHI Enterprise for customization, regulated-industry compliance and faster patching.

### Background On 17 December 2025, Docker announces that its catalog of more than **1,000 Docker Hardened Images (DHI)**, built on Debian and Alpine, becomes **free and open source under the Apache 2.0 license**. Commercially launched on 19 May 2025, DHI had until then been paid. Docker presents the move as a reset of the container security market. ### Key facts - Distroless images, with up to 95% fewer vulnerabilities than traditional community images, according to Docker (vendor claim). - Each image includes a complete software bill of materials (SBOM), public CVE data, SLSA Build Level 3 provenance and cryptographic proof of authenticity. - Paid **DHI Enterprise** for custom images, regulated-industry compliance and faster patching; **DHI Extended Lifecycle Support** for the period after upstream support ends. - Docker's AI assistant can scan existing containers and apply equivalent hardened images; the method extends to MCP servers. - Docker cites Adobe, Attentive and Crypto.com among organizations already standardizing on DHI, and more than 20 billion monthly pulls on Docker Hub. ### Why it matters Base images are the most widespread attack surface of the containerized software supply chain. A free hardened base, with SBOM and provenance, lowers the entry cost of a supply-chain security effort and puts pressure on other image vendors. For an IT services firm, it is an option to compare with other vendors' hardened images; fast-fix commitments remain on the paid Enterprise side. ### Takeaway Docker makes hardened images a free baseline and sells support and patching speed.

Tags : Sécurité, Conteneurs, Open Source, Licence, Cloud natif