ActiveState and Docker Bundle Hardened Images and Open Source Libraries

A shared route to hardened software

The ActiveState and Docker deal targets a persistent weak point in container security: teams may start with a hardened image, then add application libraries whose security and provenance receive less attention. The companies will resell one another’s curated software artifacts, giving enterprise teams a shared route to hardened container images and remediated open source libraries. The arrangement addresses a practical problem: an image can be carefully maintained while the application assembled on top of it brings in dependencies that haven’t received the same scrutiny.

That distinction matters because software teams rarely deploy a base image alone. They combine it with libraries and other components to build an application, and each addition creates another item to identify, assess, and update. A shared catalog could make those components easier to source, but the catalog’s value will depend on what happens after a vulnerability is found. Availability is only the first step; teams also need a clear way to tell what has changed and whether the artifact they’re using includes a fix.

The products are intended to support software supply chain practices aligned with Level 3 of the Supply-chain Levels for Software Artifacts (SLSA) framework. Docker has curated more than 4,000 hardened images. ActiveState offers libraries across 10 programming languages and says it can provide a hardened library within five days of an upstream project fixing a vulnerability. Those figures describe the breadth and stated response speed of the offerings, though they don’t by themselves show how quickly every component will be updated in practice.

Security gaps extend beyond the base image

A container’s base image is only one part of the software that reaches production. Application dependencies can introduce vulnerabilities of their own, so teams need visibility into those components and a way to keep them patched. A common source for hardened images and libraries could reduce the work involved in sourcing and maintaining those artifacts, especially for teams that don’t have enough engineering time to manage every dependency directly.

There’s a tradeoff here. Relying on a supplier may help teams avoid repeating maintenance work across projects, but it also makes the supplier’s update process part of the customer’s security process. Teams still need to know which components they use, how updates reach them, and whether they’ve actually adopted those updates. A safer artifact that sits unused in a repository doesn’t reduce the risk in a production application.

ActiveState CEO Abby Kearns described the arrangement as an ecosystem for hardened open source artifacts. The practical test will be how consistently suppliers can rebuild and update components as upstream fixes appear—and whether those updates arrive before attackers can exploit the underlying flaws. A fast response claim is useful, but customers will care just as much about the quality of the rebuilt artifact and the evidence that lets them trace its contents.

The urgency is rising as the interval between vulnerability disclosure and exploitation contracts. The source reports that attackers can reverse engineer a vulnerability and develop an exploit within hours, while AI is also being used to accelerate cyberattacks. A repository of hardened components may help teams reduce exposure, but only if its contents stay current and the teams using them can incorporate updates promptly. The clock doesn’t stop when a patch becomes available.

Survey results show an adoption gap

ActiveState’s survey found that 91% of application development teams have limited visibility into container components. It also found that 90% run public images that have received little modification and little or no hardening. Yet 98% of respondents ranked hardened images as a high priority. Taken together, the findings suggest that interest is widespread while practical control over deployed components remains limited.

That gap points to an execution problem: security teams recognize the value of hardened artifacts, but development organizations still have to balance maintenance against feature work. Kearns said it may take further breaches involving known vulnerabilities to shift more engineering effort toward securing applications already in use. That’s a blunt assessment of how priorities can change: the case for maintenance may be understood well before teams have the time or incentives to act on it.

The survey results are a signal of reported practices, not proof that every organization faces the same conditions. Still, they underscore why a supplier offering alone won’t solve the visibility problem. Teams need a working picture of what’s in their containers before they can decide which artifacts to replace, and they need a process for checking that replacements make it into deployed software.

The pressure also comes from the growth of AI-assisted development. In a separate ActiveState survey, 89% of respondents said their organizations use AI coding tools in production. Among that group, 94% said their organizations use more open source software as a result, in part because those components are readily available. More dependencies mean more code to track, and AI models are surfacing more vulnerabilities in open source software. The combination raises the value of reliable dependency records and timely updates, though it also leaves teams with more components to manage.

Supplier patch speed will determine the value

Mitch Ashley, vice president and practice lead for software lifecycle engineering at Futurum Group, said hardening images and libraries requires sustained engineering: teams must track dependencies, rebuild artifacts after upstream fixes, and establish provenance. Many application teams lack the staff for that work, while the time available to respond keeps shrinking. This is the kind of ongoing maintenance that can lose out to visible product work, even when teams know the security case is strong.

Buying hardened artifacts transfers some of that maintenance burden to suppliers. Ashley said the central question is whether ActiveState and Docker can rebuild and patch faster than attackers can turn vulnerabilities into working exploits. That question reaches beyond a single response-time claim: it includes how quickly suppliers identify affected artifacts, produce updates, and make those updates usable for customers.

This is more significant than it looks: the deal frames software supply chain security as an operating service, not just a one-time choice of a safer image. If you’re working in this space, the useful measure will be whether the partnership helps your team see what’s deployed and replace it quickly when a fix is available. (And this is the part most people overlook.) A curated artifact still needs to fit into the team’s build and update routines.

Here’s the thing: the partnership can make security work easier to source, but it can’t make the maintenance cycle disappear. Teams will still have to choose which artifacts to adopt and keep them current. Better starting materials. Faster updates. The impact will depend on the freshness of the images and libraries teams deploy: broader use of well-maintained artifacts can reduce the number of vulnerable components reaching production.