ActiveState and Docker Bundle Hardened Images and Open Source Libraries

Container security depends on what teams add after choosing a base image. A clean starting point can't account for every library an application later pulls in, or every change made during development. ActiveState and Docker are pairing hardened images with remediated open source libraries, giving development teams a way to source and verify artifacts across more of the software stack. The pitch is straightforward: bring more of the components under a maintained supply process, so teams have fewer gaps to track on their own.

A wider catalog of hardened components

Under the arrangement, the companies will resell each other’s curated offerings. Docker has more than 4,000 hardened images, while ActiveState provides libraries across 10 programming languages. The goal is to make both images and application dependencies available with build provenance aligned to Level 3 of the Supply-chain Levels for Software Artifacts (SLSA) framework. That combination addresses two different parts of a container: the base environment and the libraries an application needs to run.

The size of Docker’s image catalog gives the partnership breadth, but catalog size alone says little about whether a particular application is covered. Teams still need to identify which images and libraries their software uses, then decide whether the available artifacts fit their build and deployment practices. The offer is most useful when it reduces that work without obscuring what went into the finished application.

ActiveState CEO Abby Kearns said the partnership creates an ecosystem for hardened open source artifacts. ActiveState also offers a service level agreement to make a remediated library available within five days after an upstream project issues a vulnerability fix. That response time matters because a secure artifact can lose value if it takes too long to reach developers. It also gives buyers a concrete service commitment to assess, though the source doesn't specify how broadly it applies across the library catalog.

Docker provides SLSA Build Level 3 provenance, while ActiveState builds components within SLSA Level 3 infrastructure. Together, those practices help teams check how artifacts were produced and guard against build tampering. Provenance can tell teams more about an artifact’s path through a build process; it doesn't, by itself, establish that every component is free of vulnerabilities. The practical proposition is a supplier-maintained path to verified components that many application teams lack the capacity to build themselves. This is more significant than it looks: the work isn't just finding a patched package, but making sure the package in production can be traced to a process teams can inspect.

Security priorities outpace current practice

ActiveState’s survey points to a gap between stated priorities and deployment habits. While 98% of surveyed DevSecOps leaders rated hardened images a high priority, 90% said their teams still run lightly modified public images with little or no hardening. The same survey found that 91% of application development teams have limited visibility into container components. Those findings describe respondents’ reported practices, rather than proving how every organization handles containers, but the mismatch is hard to dismiss.

That gap leaves teams with less insight into the code inside their containers and more work to do when a vulnerability appears. If teams don't have a reliable inventory of components, even a known fix can be difficult to connect to the applications that need it. Kearns argued that engineering teams may need a major breach involving a known vulnerability before they shift meaningful effort from new features toward securing existing applications. That is a sharp diagnosis of a familiar organizational problem: security work competes with feature delivery until the cost of delay becomes visible.

The patch window is also under pressure. The source reports that AI has cut the time needed to reverse engineer vulnerabilities into exploits to hours, while attackers are using AI to operate at machine speed. In parallel, AI-assisted development is increasing the amount of open source code in production: a separate ActiveState survey found 89% of respondents work at organizations using AI coding tools in production, and 94% of that group said those tools have increased their use of open source software.

Those survey figures point to a growing maintenance burden, not a simple cause-and-effect story. More open source use can mean more dependencies to identify, patch and verify, while faster exploitation can leave less time to complete those tasks. Here's the thing: buying hardened artifacts can move some maintenance work to a supplier, but teams still need to know where those artifacts are used and how updates reach production.

The test is keeping pace with upstream fixes

Futurum Group vice president and software lifecycle engineering practice lead Mitch Ashley said thorough hardening demands ongoing work: teams must track dependencies, rebuild after upstream fixes and establish provenance. Many application teams lack the staff to keep up, especially as the time between vulnerability disclosure and exploitation shrinks. That workload isn't a one-time cleanup; it recurs whenever upstream projects change components or disclose a flaw.

Vendor-maintained artifacts can shift some of that workload to suppliers, but the value depends on how quickly ActiveState and Docker can rebuild and patch their catalogs. The five-day commitment cited for ActiveState addresses one point in that chain: availability after an upstream project issues a fix. Teams will still need to understand how a corrected library is selected, incorporated and deployed in their own applications. A hardened image is only one layer of protection; libraries added by an application need their own checks and updates.

There’s also a practical question of coverage. The partnership spans Docker images and ActiveState libraries, but the source doesn't say that every component an organization uses will be included. Teams with internal packages or dependencies outside the catalogs will still need a way to track and maintain them. (And this is the part most people overlook.) A supplier can make trusted artifacts easier to obtain; it can't remove the need for an accurate picture of what each application actually contains.

What engineering teams should watch

For engineering leaders, the partnership offers a way to reduce the number of exposed components reaching production. If you're working in this space, the useful questions are operational: how quickly do fixes appear, how clearly can teams verify provenance, and how easily can updated artifacts fit into existing builds? The answers will determine whether the catalog changes daily practice or simply adds another source to evaluate.

Its real measure will be whether the suppliers can deliver corrected, verifiable artifacts ahead of the increasingly short window in which attackers can turn a disclosed flaw into an exploit. The numbers here are underwhelming when set against the reported gap between security priorities and current habits. Better artifacts can help. Sustained coverage, visibility and timely updates are what will make the partnership matter.