Vancouver, British Columbia, October 22nd / PRNewswire / -- Today, we announce a reselling partnership with Docker and Inc. Docker is a company known as "a trusted platform for building software in the era of agents." This partnership combines Docker Hardened Images (the foundation for strengthening enterprise containers) with ActiveState's trusted open-source components. The two companies will jointly bring these products to market and resell each other's products as well. Enterprises can obtain strengthened container images from Docker and repaired open-source software packages that run on top of them from ActiveState, ensuring the security of their entire container infrastructure without slowing down developers.

Containers have become the default unit for modern software delivery, and securing base images is now also a fundamental expectation for security teams. Open-source software running on this foundation also requires the same level of protection. In its 2026 "Vulnerability Management and Remediation Status Report," ActiveState surveyed 250 North American DevSecOps leaders and found that 91% considered limited visibility of container components to be the biggest security blind spot, while 90% stated that their teams were still using lightly modified public images with almost no or no security enhancements at all. Meanwhile, 98% listed securing images as a high priority, indicating a gap between the needs of security teams and the existing protections in place. Docker Hardened Images is designed to fill this foundational gap, while ActiveState is responsible for addressing the security issues of the open-source software that runs on top of these containers.

ActiveState CEO Abby Kearns stated: "This collaboration fills the gap that most security teams are still facing. Even though teams have strengthened their foundational layers, they still run unverified open-source software on top of them. Docker protects the images, and ActiveState protects the content running on them, whether within containers or elsewhere. Both are built from source code and provide a verifiable origin. Together, they offer enterprises a unified standard of trust from the foundational images to every open-source component."

How does cooperation work?

Docker Hardened Images serves as the foundational reinforcement for containers, providing over 4,000 default security-enhanced and streamlined images. These images are built from source code and are compatible with Alpine and Debian. They can be used directly as replacements and come with nearly zero CVE, signed SBOM, and SLSA Build Level source provenance. This directory is freely open-source under the Apache 2.0 license. DHI Select and DHI Enterprise add CVE fixes, FIPS, and STIG versions based on SLA, as well as security customization features. ActiveState offers secure and trustworthy open-source solutions that can run on this foundation as well as in a wider range of environments: components covering 10 different language ecosystems, ranging from modern languages such as Python, JavaScript, and Java to long-established enterprise technology stacks like Perl. All are built from source code within the SLSA Level 3 infrastructure and are continuously patched in accordance with the SLA contract, then delivered to software package managers, pipelines, IDE, and AI programming tools that teams are already using. Docker Hardened Images forms the basis, while ActiveState strengthens the open-source software built upon this foundation, as well as open-source software in applications, services, and scripts that are not delivered in container form at all.

What can joint customers obtain?

• A reliable supply chain: from strengthening the foundation to the open-source software built upon it. Docker Hardened Images serves as the container foundation, while ActiveState provides open-source software for within the containers and in other environments where they run, rather than purchasing them separately and then integrating them afterward.
• Consistent source verification from both ends: Docker Hardened Images provides SLSA Build Level with 3 sources of verification and a signed SBOM; ActiveState provides SLSA Level with 3 elements for building infrastructure, thus forming a consistent chain of evidence throughout the entire software supply chain.
• Significantly reduce risks without sacrificing speed: Docker Hardened Images provides nearly zero CVE and up to 95% less attack surface, and offers a 7-day SLA for severe and high-risk CVE in production workloads. Compared to community open-source solutions, ActiveState components have about 95% fewer CVE, and a 90% faster repair time; whereas the industry average repair time often exceeds 140 days. ActiveState also provides a contractual SLA: in cases where fixes are already available in the upstream community, severe vulnerabilities must be repaired within 5 working days.

Docker, Vice President of Cooperation and Alliances, stated: "Docker Hardened Images is the foundation for building secure software that enterprises trust: it consists of over 4,000 streamlined images built from source code, accompanied by signed SBOM and SLSA Build Level proven origins. ActiveState open-source components, which have been fixed, are built upon this foundation. Customers can obtain a reinforced foundation from Docker and on top of that, they can get reviewed open-source software. At the same time, the origin of each layer can be verified, while developers can still maintain a fast delivery speed."

Availability

The reselling collaboration between Docker and ActiveState is now available. Enterprises can contact either company to plan a joint coverage solution for their container assets as well as their usage of other open-source software.

About ActiveState

ActiveState is committed to protecting the software supply chain of the AI programming era at its source. Through ActiveState Curated Catalog – a private, reviewed open-source component repository – the security team can decide which components can enter the enterprise software before they are introduced by developers or AI programming assistants. The security team gains control, while the engineering team maintains speed. Curated Catalog can be used in conjunction with the component repositories already in use by the team, scanning tools, and AI programming assistants. For more information, see activestate.com.

About Docker

Docker is the core platform for the construction of intelligent software. For over a decade, Docker has helped millions of developers and thousands of organizations to build, deliver, and run software consistently in any environment. Today, Docker is extending that same level of trust into the AI era, allowing builders and organizations to confidently adopt any models, tools, or agents without compromising on security, governance, or control. For more information, see www.docker.com.

Media Contact

Brandy Coulsey