Docker · Hardened Images
Docker Hardened Images in Saudi Arabia: secure base images for your container supply chain
Docker Hardened Images are Docker's catalogue of minimal, maintained base images for containers. Each one ships, in Docker's description, with a software bill of materials (SBOM), signed build provenance and full vulnerability data, so a security team can show what is inside every image the organisation runs. Interkey helps Saudi organisations in regulated sectors choose a tier, move Dockerfiles onto hardened bases, add scanning and policy to the pipeline, and keep images current.
In short, for executives
- What they are: minimal container base images that Docker builds, signs and patches, published on Docker Hub.
- Why they matter: most known vulnerabilities in a container come from its base image; a smaller, maintained base means fewer findings to explain to auditors.
- What it costs: Docker publishes a free Community tier under the Apache 2.0 licence, and paid Select and Enterprise tiers that add fix commitments, compliance variants and customisation.
- What Interkey does: tier choice, image migration, pipeline scanning and policy, a private registry where residency requires it, and ongoing upkeep.
At a glance
| Question | Answer |
|---|---|
| What it is | A catalogue of minimal, hardened container base images built and maintained by Docker |
| Base distributions | Alpine and Debian, as Docker states, so existing package tooling keeps working |
| What ships with each image | An SBOM, SLSA Build Level 3 provenance, a cryptographic signature and OpenVEX exploitability data |
| How it is licensed | Community tier free under Apache 2.0; Select priced per repository; Enterprise priced on request |
| Relation to Docker Business | A separate Docker product; it complements a Docker Business subscription and is not included in it |
| From Interkey | Tier choice, Dockerfile migration, scanning and policy in the pipeline, registry design and upkeep |
What Docker Hardened Images are
Every container image is built on a base: a small operating system layer plus a language runtime or a server. Most teams take it from a public registry and never look again, so it carries packages the application never uses, each with its own vulnerabilities.
Docker Hardened Images replace that base with one Docker builds and maintains. Docker describes them as near-zero CVE, secure-by-default, minimal images, and calls them drop-in replacements: migrating is, in Docker's words, designed to be as simple as changing one line in a Dockerfile, because the images keep the Alpine or Debian distribution a team already uses. Docker states that the catalogue holds more than a thousand images.
Read more
What makes them useful for container image security is the evidence that comes with them. According to Docker, every image, on every tier, ships with a complete SBOM, SLSA Build Level 3 provenance attestations, a cryptographic signature, and OpenVEX statements that say whether a listed CVE is actually exploitable in that image.
Docker Hardened Images tiers: Community, Select and Enterprise
The rows below summarise Docker's own Docker Hardened Images page as of November 2026. Docker changes its offer from time to time, so check its product page before you order.
| Question | Community | Select | Enterprise |
|---|---|---|---|
| Price | Free, Apache 2.0 licence | Priced per repository | Priced on request |
| Catalogue | Full open-source catalogue on Docker Hub | Everything in Community | Full catalogue access |
| SBOM, SLSA Build Level 3 provenance, signature, VEX | Included | Included | Included |
| Critical CVE fixes under an SLA | Not included | Under 7 days, as Docker states | Under 7 days, as Docker states |
| FIPS-validated and STIG-aligned variants | Not included | Included | Included |
| Customisation | Not included | Up to five customisations | Unlimited, including system packages |
| Extended Lifecycle Support | Not available | Not available | Add-on: up to five more years of hardened updates after upstream end of life |
Which one we recommend. Community is a sound, free start. Select or Enterprise make sense when an auditor or a contract asks for a written fix commitment, when FIPS or STIG variants are required, or when your images need your own packages and certificates built in. Enterprise with Extended Lifecycle Support suits systems that must stay on a runtime version after its upstream support ends.
Container supply-chain security in regulated Saudi sectors
Banks, insurers, telecom operators and government entities in the Kingdom are increasingly asked to show what runs in production. The National Cybersecurity Authority sets the national cybersecurity controls, and sector regulators add their own. An auditor's container questions are usually three: what is inside this image, who built it, and how quickly are its vulnerabilities fixed.
Read more
Hardened base images answer the first two with documents rather than promises. The SBOM lists every package; the signed provenance shows the image was built by Docker's pipeline and not altered afterwards. The third depends on your tier and on how quickly your pipeline picks up new bases. Our guide to the NCA Essential Cybersecurity Controls explains, in general terms, how controls like these map to an assessment.
Hardened images, SBOMs, Docker Scout and container vulnerability scanning
A hardened base does not remove the need to scan: your application adds its own libraries on top. Container vulnerability scanning stays in the pipeline; what changes is how much of the result is noise.
- SBOM. The bill of materials Docker ships with each hardened image is the starting inventory; your build adds the application layer to it.
- Docker Scout. Docker's image analysis service generates an SBOM for each image, matches it against continuously updated CVE data, evaluates images against policies you define, and recommends a patched base image when the current one has a known issue.
- VEX. The OpenVEX statements that come with each hardened image record whether a CVE is exploitable in that image, so security teams can rank findings by real risk rather than by raw scanner counts.
- Policy gates. The pipeline refuses images without an approved base or with an unplanned critical finding.
Docker Scout has its own plan terms; we confirm your subscription covers it before designing around it.
Where Docker Hardened Images fit, and where they do not
They fit an organisation that builds its own images, ships often, and must explain vulnerability findings to a security team or auditor, especially where a few runtimes serve many services, so one base change improves them all.
Read more
They are not a fix for an application that is still unready for containers, and minimal images can break a Dockerfile that expects a shell or a package manager at run time; those builds need a multi-stage rewrite first. They also do not license Docker Desktop for your developers: that is Docker Business, a separate subscription whose Registry Access Management and Image Access Management controls can restrict developers to approved images. If the applications themselves have yet to move, the Docker and Kubernetes practice and the Kubernetes migration guide come first.
Docker Hardened Images pricing: what drives the cost
Docker publishes its tier prices on its product page and changes them from time to time, so this page prints none. What moves the total:
- The tier. Community is free; Select is priced by Docker per repository; Enterprise is quoted by Docker.
- The number of repositories. An inventory usually shows fewer distinct bases than teams expect.
- Customisation and lifecycle. Custom packages and Extended Lifecycle Support move a contract up to Enterprise.
- The migration work. Dockerfile changes, testing, pipeline gates and registry design are Interkey's own lines, quoted apart from any Docker subscription.
What Interkey delivers with Docker Hardened Images
We start with an inventory of every base image you use and its findings today, then recommend a tier and a migration order, most common runtimes first. Paid tiers can be bought from Docker directly or arranged through Interkey with the project. Each Dockerfile moves to a hardened base, multi-stage where needed, and is tested before the old base is retired.
Read more
In the Kingdom, data residency usually shapes the registry. Docker Hub is Docker's hosted service; a private registry on infrastructure you operate keeps your own built images inside Saudi Arabia when your rules require it, with the pipeline pulling hardened bases in and pushing finished images there. Our engineers work from Riyadh, in Arabic and English, on the Sunday-to-Thursday week, and managed services can keep the images rebuilt and scanned under a written scope. The Docker FAQ covers the wider platform work.
Relatedmanaged services
How a move to hardened images runs
-
Inventory.
Every base image in use, where it is pulled from, and the vulnerabilities it carries today.
-
Tier and order.
Community, Select or Enterprise, and which runtimes move first.
-
Migrate.
Dockerfiles moved to hardened bases, multi-stage where needed, and tested in your pipeline.
-
Gate.
Scanning, SBOM checks and policy rules that stop unapproved bases reaching production.
-
Registry.
A private registry where residency requires it, and approved-image rules for developers.
-
Keep current.
Rebuilds when Docker patches a base, and support from Riyadh.
Questions buyers ask
Are Docker Hardened Images free to use in Saudi Arabia?
The Community tier is, under the Apache 2.0 licence, and Docker states it has no usage restrictions. The Select and Enterprise tiers are paid and add a fix commitment for critical CVEs, FIPS and STIG variants and customisation. The same terms apply in the Kingdom.
Do Docker Hardened Images come with Docker Business?
No. Docker Hardened Images is a separate Docker product with its own tiers. Docker Business licenses Docker Desktop and adds controls such as image access management, which can be used to keep developers on approved hardened bases.
What does a hardened base image give our auditors?
Documents: an SBOM listing every package, signed SLSA Build Level 3 provenance showing who built the image, and VEX statements on which CVEs are exploitable. Your auditors still decide what evidence they need.
Do we still need container vulnerability scanning with hardened images?
Yes. The hardened base covers the operating system layer and runtime, but your application adds its own libraries. Scanning stays in the pipeline; it simply reports far fewer base-image findings to work through.
How long does a move to Docker Hardened Images take?
It depends on how many distinct base images you use, how many Dockerfiles expect a shell or package manager at run time, and how your pipeline is tested. A pilot on one runtime comes first; we estimate the rest after the inventory.
Can our container images stay inside the Kingdom?
Yes. Hardened bases are pulled from Docker Hub, but the images you build on them can be pushed to a private registry on infrastructure you operate in Saudi Arabia, and your clusters pull only from there.
Next
Read next
Next step
Plan a move to hardened base images
Tell us roughly how many services you build, on which runtimes, where your registry runs and what your auditors ask for. We will reply with a tier, a migration order and a scope.
Or directly
+966-11-2180999 [email protected]Tawuniya Towers, North Tower, 7th Floor, King Fahad Highway, Olaya, P.O. Box 56835, Riyadh 11564, Saudi Arabia