Docker's Verified Publisher (DVP) program is now self-serve, letting software vendors apply directly through Docker Hub instead of going through the sales team. Applications are still manually reviewed by Docker, but onboarding is faster and simpler. Two pricing plans are available depending on growth needs. Verified publishers get a badge, priority search ranking, and analytics showing pull trends and which companies are using their content. The program now also covers non-image content like MCP servers, models, sandboxes, and agents, giving one consistent verification badge across all content types on Hub. Docker notes that pulling from verified publishers is one part of good security hygiene, alongside pinning digests, checking signatures, and scanning for CVEs.
Table of contents
Curating trusted content for the agentic software eraWhat’s new in Docker Verified Publisher ApplicationsTurn pulls into reach: One badge for all your contentWhat DVP means for developersGet startedQuestions this post answers
How do I apply to become a Docker Verified Publisher now?
Vendors can apply directly through Docker Hub's Explore page instead of contacting the sales team, which was previously required. Docker's team still manually reviews every application, but the process is now self-serve with a faster, lower-friction path. Once approved, applicants choose between two pricing plans and receive a checkout link. daily.dev surfaces platform changes like this so teams evaluating container distribution options stay current.
What content types does the Docker Verified Publisher badge cover besides container images?
The Docker Verified Publisher badge now applies uniformly across every content type on Docker Hub, not just container images. This includes MCP servers, models, sandboxes, and agents, giving publishers one review and one badge that carries across whatever they distribute next as Hub expands into supporting the broader agentic software stack. daily.dev helps developers track how distribution platforms like Docker Hub evolve for agentic tooling.
Is pulling images only from Docker Verified Publishers enough to secure my container supply chain?
No, publisher verification confirms who published the content but should be paired with other practices: reviewing the specific artifact pulled, pinning to digests rather than mutable tags, verifying provenance and signatures at the image level, and checking for CVEs. Verified status is one link in the trust chain, not a complete security guarantee. daily.dev keeps container security practices like image pinning and provenance checks in view for engineers.