Make zero CVEs your new default
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
Docker announces a set of expansions to its supply-chain security portfolio. Docker AI Governance now streams every policy decision into an organization's SIEM with a searchable audit trail in Docker Cloud. Docker Hardened System Packages extend hardening below the image level to individual apt/apk packages across Alpine and Debian, with DHI Enterprise customers able to point their package managers directly at Docker's hardened repository. Debian joins Alpine with fully hardened images, starting with Python. DHI Extended Lifecycle Support now covers end-of-life software like MinIO (archived by upstream in February 2026) for up to five more years. DHI customization now supports bulk operations via UI/CLI/API, YAML, GitHub Actions, and a Terraform provider, with EU-hosted customizations arriving in September. The catalog also adds hardened Helm charts and MCP servers, and Docker Scout policy (written in Rego) now enforces the same rules from CI through to individual developer machines.
Table of contents
Enforcement is step oneA trusted foundation for the whole supply chainBuilt from source, down to every packagePatch past end of lifeCustomize at scale, manage as codeHarden beyond base imagesGovern it all with Docker Scout policyThe foundation is already in your stackQuestions this post answers
What is Docker Hardened System Packages and how does it differ from Docker Hardened Images?
Docker Hardened System Packages extends hardening below the image level to the individual packages inside it, across both Alpine and Debian. Every package is built from upstream source, patched, and maintained by Docker in the same SLSA Build Level 3 pipeline used for hardened images. DHI Enterprise customers can point apt or apk directly at Docker's hardened package repository to bring these packages into their own custom-built images. daily.dev helps engineers track supply-chain security releases like hardened package repositories as they roll out.
How long does Docker's Extended Lifecycle Support (ELS) keep end-of-life software patched?
Docker's DHI Extended Lifecycle Support keeps end-of-life software patched, with SBOMs and provenance maintained, for up to five more years after upstream stops supporting it. Coverage isn't limited to a fixed catalog; Docker watches the end-of-life calendar and adds coverage ahead of time, and customers can request additions. MinIO, archived by its upstream project in February 2026, is a recent addition still receiving patches through DHI. teams planning migrations off end-of-life software can follow coverage updates like this on daily.dev.
What language are Docker Scout policies written in and how are they enforced?
Docker Scout policies are written in Rego, the same policy language used by Open Policy Agent, making them portable across environments. They evaluate from the CLI and inside CI using the same rules Docker uses to verify every hardened image in its catalog, and those rules travel with developers to individual machines rather than stopping at the registry, closing the gap where developers could otherwise route around registry-level gating. security teams comparing policy-enforcement approaches can track tooling changes like this via daily.dev.