Docker and ActiveState Extend Trusted Security to Open Source Packages
Docker is partnering with ActiveState to extend its trusted-content approach from container images to the open source packages developers and AI coding assistants install. The integration combines Docker Hardened Images with ActiveState’s Curated Catalog, allowing teams to use familiar package managers while sourcing approved dependencies through governed repositories.
- Docker is partnering with ActiveState on trusted content for container images and open source packages.
- Docker Hardened Images include signed SBOMs, SLSA Build Level 3 provenance and full CVE visibility.
- ActiveState’s Curated Catalog supplies approved packages compiled from original source code.
- Developers and AI coding assistants can continue using familiar package managers.
- Docker and ActiveState will resell each other’s offerings.
Security across both supply chain layers
Docker Hardened Images provide the base layer for the partnership. Docker says the images are open source under Apache 2.0 and available in a catalog of 4,000+ minimal images built from source and continuously maintained by Docker. The catalog also includes customizable Helm charts and over 65,000 hardened system packages.
These images are designed to reduce the vulnerabilities inherited from a container foundation by removing unnecessary packages, rebuilding components from source and maintaining the images continuously. Each image includes a signed SBOM and SLSA Build Level 3 provenance, along with full, unsuppressed CVE visibility. Paid tiers add a 7-day SLA for critical and high CVEs, as well as FIPS and STIG variants and secure customization.
Docker says the images were not affected when the TeamPCP campaign weaponized a widely trusted security scanner in March. According to the company, its controlled build pipeline and dependency cooldown periods helped prevent compromised upstream artifacts from entering the image build process during that attack window.
ActiveState governs application dependencies
ActiveState’s Curated Catalog addresses the application layer above the base image. It is a private, policy-governed repository containing only the open source components a team has approved. ActiveState compiles each component from original source code in a SLSA Level 3 environment, providing full provenance and complete SBOMs instead of relying on pre-compiled binaries from public registries.
When an upstream fix becomes available, ActiveState automatically rebuilds the component and publishes it to the catalog. Its stated remediation targets are 5 business days for critical CVEs and 10 for high CVEs.
The integration is intended to preserve existing development workflows. An artifact repository such as Artifactory or Nexus can point to the Curated Catalog as its upstream, while developers continue using familiar pip and npm workflows. AI coding assistants receive the governed versions of packages rather than pulling directly from public registries.
A governed source for developers and AI agents
Docker says the combined offering gives security teams a consistent evidence trail from the hardened image to the packages built on it. Both layers carry provenance, SBOMs and a remediation SLA, with clearer responsibility for addressing vulnerabilities.
The partnership does not replace pinned digests, cooldown periods or sandboxed agents recommended by Docker CISO Mark Lechner. Instead, it provides a governed source for those controls to use. Docker now resells the ActiveState Curated Catalog alongside Docker Hardened Images, while ActiveState resells DHI to its customers. Both offerings are available through Docker.
The arrangement reflects Docker’s stated aim of making secure defaults available as software is produced more quickly by AI coding agents. Those agents can generate applications, select dependencies and initiate builds, so the packages they are allowed to consume become a central part of supply chain security.
