Docker Hardened Images Are Now Free: A Container Security Game Changer

In a massive shift for the DevSecOps landscape, Docker announced on December 17, 2025, that Docker Hardened Images (DHI) are now free and open source for all developers.

Previously a commercial-only offering, this move democratizes access to production-ready, secure container foundations. With supply chain attacks costing the industry over $60 billion in 2025, this release provides a critical layer of defense for everyone from solo developers to large enterprises.

Here is what you need to know about DHI and why you should switch your base images today.

What to Remember

• DHI is Now Free: Formerly a paid feature, Docker Hardened Images are now open source (Apache 2.0) and available to all 26 million+ developers.
• Enhanced Security: These images offer near-zero CVEs, signed SBOMs, and SLSA Build Level 3 provenance for a secure supply chain.
• Drop-in Replacements: Built on Alpine and Debian, they are designed to replace standard images with minimal to no retooling required.
• Two Tiers: While the images are free, an Enterprise tier exists for organizations needing SLA-backed patching, FIPS/FedRAMP compliance, and extended support.

What Are Docker Hardened Images?

Docker Hardened Images are minimal, opinionated base images designed to reduce your attack surface. Built on trusted foundations like Alpine and Debian, they are designed to be “drop-in” replacements for standard images, requiring little to no retooling of your Dockerfiles.

Key technical benefits include:

• Near-Zero CVEs: Drastically reduced vulnerabilities compared to standard base images.
• Transparency: Every image comes with a signed SBOM (Software Bill of Materials) and SLSA Build Level 3 provenance.
• Efficiency: Images are up to 95% smaller, speeding up build and deployment times.
• Open Source: Released under the Apache 2.0 license, ensuring no licensing surprises.

Free vs. Enterprise: What’s the Difference?

While the images themselves are now free for the world’s 26 million+ developers, Docker has structured DHI into two clear tiers based on organizational needs:

1. DHI Free (The New Standard)

• Access: Access to over 1,000 hardened images (including Helm charts and MCP servers).
• Transparency: Full transparency regarding CVEs (Docker does not suppress vulnerability data).
• Target Audience: Ideal for most development teams and open-source projects.

2. DHI Enterprise (For Strict Compliance)

• SLA-Backed Patching: A guarantee that critical CVEs are remediated in under 7 days.
• Compliance Ready: Variants available for FIPS, FedRAMP, and STIG compliance.
• Extended Lifecycle Support (ELS): Security patching for up to 5 years after upstream support ends—critical for legacy enterprise apps.
• Customization: Access to Docker’s secure build infrastructure to customize images without breaking the chain of trust.

Why You Should Migrate

Security is no longer just about your code; it is about what your code runs on. By switching to DHI, you eliminate the “noise” of hundreds of non-critical vulnerabilities that often plague standard images, allowing security teams to focus on real threats.

Because DHI maintains compatibility with standard Alpine and Debian distributions, migration is often as simple as updating the FROM line in your Dockerfile.

How to Get Started

You can start using these images immediately via Docker Hub.

• Browse the Catalog: Look for the DHI badge on Docker Hub.
• Scan Your Repo: Docker is rolling out AI-assisted tools to scan your existing containers and recommend the equivalent Hardened Image.

By making DHI free, Docker isn’t just selling a product; they are raising the baseline for the entire internet’s security posture.

To further enhance your cloud security and implement Zero Trust, contact me on LinkedIn Profile or [email protected]

Frequently Asked Questions (FAQ)

What are Docker Hardened Images (DHI)?

Docker Hardened Images are minimal, opinionated base images designed to reduce attack surfaces with near-zero CVEs, built on trusted foundations like Alpine and Debian.

Is DHI really free now?

Yes, as of December 17, 2025, DHI is free and open source under the Apache 2.0 license for all developers, providing access to over 1,000 hardened images.

What is the difference between DHI Free and Enterprise?

DHI Free offers full transparency and access, while DHI Enterprise adds SLA-backed patching (critical CVEs in under 7 days), compliance readiness (FIPS, FedRAMP), and extended lifecycle support.

How do I migrate to DHI?

Migration is often as simple as updating the `FROM` line in your Dockerfile, as DHI maintains compatibility with standard Alpine and Debian distributions.

Where can I find these images?

You can browse the catalog for the DHI badge on Docker Hub or use Docker's tools to scan your repository and recommend the equivalent Hardened Image.

Resources

• Official Docker Documentation: https://docs.docker.com/dhi (Link illustrative based on context)
• Docker Hub: Explore the DHI catalog.
• SLSA Framework: Learn about Supply-chain Levels for Software Artifacts.