Docker and ActiveState Partner to Secure Enterprise Containers
Docker and ActiveState have announced a reselling partnership combining Docker Hardened Images with ActiveState's curated open-source packages to secure enterprise container supply chains.
Before you start: versions, package names and storage identifiers change over time. Check the commands against the official documentation for your setup before running them, especially anything that creates, deletes or overwrites data.
Docker, Inc. and ActiveState have announced a new reselling partnership designed to secure enterprise container supply chains by pairing secure base images with curated open-source packages. The partnership, announced on October 22, 2026, aims to help enterprise development and security teams gain better visibility and control over what runs inside their container environments.
According to survey data cited by the companies from 250 North American DevSecOps leaders, 91% identified visibility into container components as their primary blind spot, specifically concerning what gets layered on top of base images. Furthermore, 90% of respondents reported that their teams continue to run lightly modified public images with little to no hardening. This vulnerability gap is exacerbated by AI coding assistants adding software dependencies faster than manual reviews can handle, alongside mounting pressure from regulations like the EU Cyber Resilience Act.
Combining Hardened Bases With Curated Dependencies
The collaboration integrates Docker Hardened Images (DHI) with ActiveState’s curated open-source component catalog. Docker Hardened Images provide minimal, secure-by-default container options featuring over 4,000 images built from source, near-zero CVE counts, signed Software Bills of Materials (SBOMs), and SLSA Build Level 3 provenance. While DHI focuses on the container foundation, ActiveState extends security to the open-source packages developers layer on top.
ActiveState’s catalog covers more than a dozen language ecosystems—including Python, JavaScript, Java, Perl, Tcl, and Ruby. Its components are also built from source, continuously maintained, and integrated into existing package managers, pipelines, IDEs, and AI tools.
Practical Consequences and Availability
The partnership provides organizations with a more consistent evidence trail across the software supply chain by utilizing SLSA Build Level 3 standards for both base images and application dependencies. Docker Hardened Images offer a 95% smaller attack surface with a 7-day SLA for critical and high-severity CVEs, while ActiveState promises 90% faster remediation and a 5-day SLA for critical vulnerabilities compared to standard community open source.
The reselling partnership between Docker and ActiveState is available immediately.
Source
Official announcement or documentation
Some links on this page may be affiliate links. If you buy through them we may earn a commission at no extra cost to you. See our affiliate disclosure.
