> ## Content Index
> Fetch the complete content index at: https://itsfoss.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Docker Makes Enterprise-Grade Hardened Images Free for All Developers
- URL: https://itsfoss.com/news/docker-hardened-images-open-sourced/
- Published: 2025-12-19T13:53:21.000Z
- Updated: 2025-12-19T13:53:21.000Z
- Description: Previously enterprise-only hardened images go open source under Apache License 2.0.
- Author: Sourav Rudra
- Tags: News, Enterprise

[Docker](https://www.docker.com/?ref=itsfoss.com) is the platform that [made containers mainstream](https://linuxhandbook.com/courses/docker/?ref=itsfoss.com). It lets developers package applications with dependencies into standardized units that run consistently across different environments.

Earlier this year, they launched [Docker Hardened Images](https://www.docker.com/products/hardened-images/?ref=itsfoss.com) (DHI), a collection of secure, minimal container images. These images include complete Software Bill of Materials (SBOM), SLSA Build Level 3 provenance, and transparent vulnerability reporting.

But DHI **was previously enterprise-only**. Docker has now [made it free and open source](https://www.docker.com/blog/docker-hardened-images-for-every-developer/?ref=itsfoss.com).

## DHI for Everyone

The images are released under [Apache License 2.0](https://www.apache.org/licenses/LICENSE-2.0?ref=itsfoss.com), with hardened versions of popular images built on **Alpine** and **Debian** freely available. According to Docker, these images have **up to 95% smaller attack surfaces** compared to standard images.

Alongside this, they also released **Hardened MCP Servers** for AI applications. The [MCP](https://modelcontextprotocol.io/docs/getting-started/intro?ref=itsfoss.com) servers include hardened versions for MongoDB, Grafana, GitHub, and other commonly used services.

Moreover, **Docker now offers DHI in three tiers**. The **free open source version** gives everyone access to hardened images with SBOM and provenance.

**DHI Enterprise** adds a 7-day [SLA](https://en.wikipedia.org/wiki/Service-level%5Fagreement?ref=itsfoss.com) for critical CVE remediation, [FIPS](https://en.wikipedia.org/wiki/Federal%5FInformation%5FProcessing%5FStandards?ref=itsfoss.com)\-enabled images, [STIG](https://en.wikipedia.org/wiki/Security%5FTechnical%5FImplementation%5FGuide?ref=itsfoss.com)\-ready configurations, and image customization. With this, organizations can modify images, add certificates, and build on Docker's infrastructure while maintaining compliance.

**DHI Extended Lifecycle Support** (ELS) is a paid add-on for the above that extends security patches up to five years beyond upstream *end-of-life*. This addresses the problem of maintaining legacy systems that still need security updates after official support ends.

Announcing this move, [Christian Dupuis](https://www.linkedin.com/in/christiandupuis/?ref=itsfoss.com), Senior Principal Engineer at Docker, added that:

> Today’s announcement marks a watershed moment for our industry. Docker is fundamentally changing how applications are built-secure by default for every developer, every organization, and every open-source project.

> This moment fills me with pride as it represents the culmination of years of work: from the early days at Atomist building an event-driven SBOM and vulnerability management system, the foundation that still underpins Docker Scout today, to unveiling DHI earlier this year, and now making it freely available to all.

You can get started with Docker Hardened Images at the [official portal](https://hub.docker.com/hardened-images/catalog?ref=itsfoss.com) (*needs an account*). For the source, visit [GitHub](https://github.com/docker-hardened-images?ref=itsfoss.com), and for instructions, check the [documentation](https://docs.docker.com/dhi/get-started/?ref=itsfoss.com).

[Docker Hardened Images (GitHub)](https://github.com/docker-hardened-images?ref=itsfoss.com)

---

**Suggested Read 📖:** [The First Rust CVE in Linux Kernel](https://itsfoss.com/news/first-linux-kernel-rust-cve/)

[The First Rust CVE in Linux Kernel Only Makes Your System CrashGreg Kroah-Hartman announced this alongside 150+ C code vulnerabilities that were addressed.![](https://itsfoss.com/content/images/icon/android-chrome-512x512-137.png)It's FOSSSourav Rudra![](https://itsfoss.com/content/images/thumbnail/linux-kernel-first-rust-cve.png)](https://itsfoss.com/news/first-linux-kernel-rust-cve/)