Skip to main content

Episode #063: Docker Hardened Images - Free Security for Every Developer

Duration: 11 minutes | Speakers: Jordan & Alex | Published: December 18, 2025

Target Audience: Senior platform engineers, DevOps engineers, SREs responsible for container security and supply chain compliance.

Episode Summary​

Docker just made enterprise-grade container security free and open source. On December 17, 2025, Docker released over 1,000 hardened container images under the Apache 2.0 license—previously a commercial offering since May 2025. These images reduce vulnerabilities by up to 95% compared to standard community images, as validated by SRLabs.

Key Topics:

  • 1,000+ hardened container images under Apache 2.0 license
  • 95% CVE reduction validated by independent security consultancy SRLabs
  • Distroless runtime: only what's needed to run, nothing extra
  • SBOM, VEX, and SLSA Level 3 provenance included
  • 7-day patch SLA for critical vulnerabilities
  • Enterprise tier adds FIPS compliance, STIG configurations, 5-year ELS
  • Hardened MCP server images for AI agent infrastructure

News Segment:

  • First Linux Kernel Rust CVE (CVE-2025-68260): Race condition in Android Binder Rust rewrite
  • GitHub Actions pricing changes: 39% reduction, self-hosted billing postponed indefinitely

Transcript​

Jordan: Today we're diving into a fundamental shift in container security economics. Supply chain attacks are projected to cost businesses sixty billion dollars globally in 2025. And the root cause of most container vulnerabilities? They're inherited from base images. Docker just made the solution free.

Alex: But first, let's run through some major news that dropped this week. And we have to start with a historic first, Jordan. The Linux kernel Rust code has its first CVE.

Jordan: CVE 2025 68260. This is a race condition in the Android Binder Rust rewrite, affecting Linux 6.18 and newer. The vulnerability is in an unsafe code block, and it results in memory corruption that can cause a crash.

Alex: The key detail here is that it's a denial of service issue, not remote code execution. The system crashes, but there's no ability for an attacker to take control or execute arbitrary code.

Jordan: What makes this significant is the framing. Rust doesn't eliminate all security issues. It eliminates certain classes of memory safety bugs in safe code. Unsafe blocks still need the same careful review that C code requires.

Alex: The Rust community will correctly point out this was in unsafe code. The skeptics will say Rust still has CVEs. Both miss the point. This is just normal software maintenance happening in a new language. It's a milestone for security tracking, not a failure of the language.

Jordan: Second story. GitHub Actions pricing changes are coming in January 2026, and the details are actually favorable for most teams.

Alex: GitHub is reducing hosted runner costs by up to thirty-nine percent. There's a new two-tenths of a cent per minute platform charge, but that's already baked into the reduced rates. The self-hosted runner billing that had everyone worried? Postponed indefinitely.

Jordan: The stat that matters: ninety-six percent of customers will see no change to their bill. Public repositories remain completely free. GitHub acknowledged they missed the mark on the self-hosted announcement and are going back to the community for feedback.

Alex: For that four percent affected, eighty-five percent are actually seeing decreases. The median increase for individual developers on private repos is under two dollars per month. This is a case where community backlash actually worked.

Jordan: Alright, let's get into the main topic. Docker just made enterprise-grade container security free and open source. And Alex, this is a bigger deal than the headline suggests.

Alex: On December 17th, Docker announced they're releasing their entire catalog of over one thousand hardened container images under the Apache 2.0 license. These were previously a commercial offering since May of this year. Now they're free.

Jordan: Let's talk numbers first. These hardened images reduce vulnerabilities by up to ninety-five percent compared to standard community images. That's not marketing. That was independently validated by SRLabs, a cybersecurity consultancy.

Alex: SRLabs found no root escapes or high-severity breakouts in their assessment. The images are signed, rootless by default, and ship with complete software bill of materials plus vulnerability exploitability exchange data.

Jordan: For platform engineers, that last part is critical. SBOM requirements are becoming standard. Executive Order 14028 in the US, similar regulations globally. Having SBOM baked into your base images means you're not scrambling to generate it at build time.

Alex: The technical approach here is what they call distroless runtime. Only what's needed to run the application. No shell, no package managers, no unnecessary utilities that expand attack surface.

Jordan: Let me explain why this matters so much. If you're running a hundred services in production, and they all inherit from the same vulnerable base image, you have a hundred services with the same vulnerability. The base image is the foundation of your entire container estate.

Alex: Traditional community images often have dozens or hundreds of CVEs. Most are unexploitable in your specific context, but your vulnerability scanner doesn't know that. You spend engineering time triaging noise instead of fixing real issues.

Jordan: With hardened images, SRLabs validated a ninety-five percent reduction in attack surface. That's not ninety-five percent fewer CVEs in the scanner. That's ninety-five percent less attack surface for an adversary to probe.

Alex: There's also a seven-day patch SLA for critical vulnerabilities. Compare that to community images where patches might take months. Docker is building toward a twenty-four hour SLA for their enterprise tier.

Jordan: Speaking of the enterprise tier, let's be clear about what's free versus paid. The base hardened images, the Apache 2.0 license, the SBOM, the SLSA Level 3 provenance, all of that is free.

Alex: The paid enterprise tier adds SLA-backed CVE remediation, FIPS-enabled images for government and regulated industries, STIG-ready configurations, and extended lifecycle support. That's five years beyond upstream end of life.

Jordan: For most platform engineering teams, the free tier is sufficient. The enterprise tier makes sense for regulated industries, FedRAMP requirements, or organizations that need guaranteed patch timelines in writing.

Alex: Let's talk about what's actually included. Over a thousand images covering the major language runtimes. Node.js, Python, Go, Java, .NET. Popular databases and infrastructure components. PostgreSQL, Redis, MongoDB.

Jordan: And here's what caught my attention. Hardened MCP server images. Grafana, MongoDB, GitHub integrations. If you're building AI agent infrastructure, this matters. Those MCP servers are attack surface you didn't have before generative AI.

Alex: Let's be realistic about migration. These are distroless images, which means the filesystem layout is different. Your debugging approach changes when there's no shell.

Jordan: The recommended approach is multi-stage builds. Use a full development image for building and testing, then copy artifacts to the hardened image for runtime. This gives you the best of both worlds.

Alex: Test thoroughly. Some applications make assumptions about what's available in the container. Path expectations, temp directories, specific utilities. These assumptions may not hold in a distroless environment.

Jordan: Now, the skeptic's view. The developer community on sites like DevClass noted some wariness. Docker has a history of reducing free offerings and pushing subscriptions. Will this stay free?

Alex: Fair question. The Apache 2.0 license provides some protection. If Docker changes course, you can fork the work. The SBOM and provenance data are portable. You're not locked in to Docker's ecosystem.

Jordan: The strategic calculus for Docker is probably about ecosystem adoption. If everyone uses hardened images, Docker Hub becomes more central to the container supply chain. That's valuable even without direct monetization.

Alex: There's also the enterprise upsell path. Free hardened images establish the value proposition. When you need guaranteed SLAs or FIPS compliance, the enterprise tier is waiting.

Jordan: Let's talk practical steps for Monday morning. First, audit your current base images. How many CVEs are your vulnerability scanners reporting? Most organizations are surprised by the number.

Alex: Second, identify your top five most-used base images. These are the ones inherited by the most services. Prioritize those for migration to hardened variants.

Jordan: Third, check Docker Hub for hardened equivalents. The naming convention is straightforward. Look for the hardened designation in the image tags.

Alex: Fourth, create a test pipeline with hardened image variants. Don't do a big bang migration. Pick one service, swap the base image, run your test suite, compare vulnerability scanner output.

Jordan: The decision framework is simple. For production containers where security matters, and it should always matter, use hardened images. For development environments where you need debugging tools and shells, community images are fine.

Alex: The edge cases are niche applications without hardened variants, or situations where the distroless constraints are genuinely incompatible with your application architecture. Those exist, but they're the minority.

Jordan: The big picture takeaway here is that security has historically been expensive. Enterprise-grade container security was a line item, a procurement decision, something you had to budget for.

Alex: Docker just made it free and open source. For platform engineers building internal developer platforms, this is a quick win. Swap base images, get ninety-five percent fewer CVEs, and check the SBOM compliance box.

Jordan: The supply chain security game changed on December 17th, 2025. The question is how quickly your organization adapts.

Alex: That's Docker Hardened Images. Free security for every developer.

Resources​

Monday Checklist​

  1. Audit your current base images for CVE counts
  2. Identify top 5 most-used base images in your org
  3. Check if hardened equivalents exist on Docker Hub
  4. Create test pipeline with hardened image variants
  5. Compare vulnerability scanner output

← Back to Podcast Index