Stop Shipping Vulnerabilities by Default: An Intro to Docker Hardened Images

Docker Hardened Images are changing how teams think about container security — not as an...

Docker Hardened Images are changing how teams think about container security — not as an afterthought, but as a starting point.

The problem nobody talks about until it's too late

You've just pushed a new feature. CI is green. The pull request is merged. You pour yourself a coffee and move on. Then three weeks later, your security scanner lights up like a Christmas tree — and the culprit isn't your code. It's the base image you pulled from Docker Hub without a second thought.

This is the silent contract most developers have unconsciously signed: ship fast, worry about CVEs later. And it works — until it doesn't.

A standard ubuntu:latest or node:20 image ships with hundreds of packages you never asked for — shell utilities, package managers, debug tools, old libraries. Each one is a potential attack surface. Most containers don't need them. All of them carry risk.

Some numbers to put this in perspective:

• ~70% of container images have high or critical CVEs on day one
• A typical node:20 base image includes 400+ packages
• Around 60% of those packages are never used by the app itself

The uncomfortable truth? The problem isn't that your code is insecure. It's that the foundation you're building on was never designed with production hardening in mind.

Enter Docker Hardened Images (DHI)

Docker Hardened Images are a curated set of production-ready, security-hardened base images offered through Docker Hub. They're not just "smaller images" or "images with fewer packages." They represent a deliberate philosophy: run only what your app actually needs.

What makes DHI different:

• Minimal attack surface — stripped to runtime dependencies only
• CVE-free at release — zero known vulnerabilities when the image ships
• No shell by default — no bash, no sh, no unnecessary entry points
• Signed & verifiable — Sigstore/cosign image signing included
• SLSA provenance — full supply chain attestation
• Regular patched releases — fast, predictable patch cadence
• Non-root user by default — runs as nonroot out of the box
• Multi-arch support — works on amd64 and arm64

"Security isn't a layer you add on top. With DHI, it's the layer you start from."

What it looks like in practice

Migrating to DHI doesn't require a complete rewrite. In most cases, it's a one-line change in your Dockerfile — with a very noticeable difference in your vulnerability scan output.

# Before — standard Node image, ~500 packages, ~30 CVEs
FROM node:20
WORKDIR /app
COPY . .
RUN npm ci --omit=dev
CMD ["node", "server.js"]

# After — Docker Hardened Image, minimal footprint, 0 known CVEs
FROM docker.io/docker/hardened-node:20
WORKDIR /app
COPY --chown=nonroot:nonroot . .
RUN npm ci --omit=dev
USER nonroot
CMD ["node", "server.js"]

That's essentially it for a simple app. The image is smaller, the scan is clean, and you're running as a non-root user out of the box. Your CI pipeline, your orchestrator, your deployment process — none of that changes.

Heads up: DHI images don't include a shell. This means you can't docker exec -it container bash anymore. That's intentional — and it's also the whole point. If you need to debug, use ephemeral debug containers or structured logging.

Where DHI actually shines — real use cases

Production APIs & microservices

Internet-facing services are the highest-priority targets. DHI reduces the surface area attackers can reach even if they find an entry point.

Compliance-heavy environments

SOC 2, PCI-DSS, HIPAA all require you to demonstrate you're minimizing risk. A CVE-free base image with signed provenance is audit gold.

Kubernetes workloads

Pods with minimal images mean smaller escape vectors. Combine DHI with Pod Security Standards for defense in depth that actually holds up.

CI/CD pipelines

Build runners and job containers that execute untrusted code should never have more capabilities than they need. DHI enforces exactly that.

Serverless & Lambda-style functions

Tiny images mean faster cold starts. When you're paying per millisecond, stripping unused packages is both a security and a cost win.

Regulated industries

Finance, healthcare, and government workloads benefit from the SLSA provenance and signed attestations DHI ships with every image.

DHI vs. what you're probably using now

Is it worth the migration effort?

For most services: yes, and faster than you'd expect. The majority of Node.js, Python, and Go apps can be migrated in under an hour. The main adjustment is getting comfortable without a shell — which, once you adapt your debugging workflow, is actually freeing.

The harder cases are apps that rely on shell scripts inside the container during startup, or that dynamically install packages at runtime (you shouldn't be doing that anyway, but here we are). For those, DHI offers variants with slightly more tooling so you can migrate incrementally.

The real question isn't whether the migration is worth it. It's whether your current posture — knowingly shipping containers with 30+ CVEs — is a risk you want to keep accepting. Especially when the fix is one line in a Dockerfile.

Ready to ship your first hardened container?

Docker Hardened Images are available on Docker Hub today. Here's how to get started:

1. Pick your runtime — Node, Python, Go, Java — DHI has you covered
2. Swap the FROM line in your Dockerfile
3. Run a vulnerability scan — compare it to your current image
4. Adjust your debug workflow — ephemeral containers, structured logs
5. Ship it

The difference will be obvious from the first scan. And your future self — the one who doesn't have to explain a CVE breach to stakeholders — will thank you.

Have you already migrated to DHI or distroless images? Share your experience in the comments — especially if you hit any gotchas worth warning others about.

Tags: docker security devops containers devsecops