New reseller agreement pairs Docker Hardened Images with ActiveState’s trusted open source, securing the container and everywhere else open source runs, without slowing developers down.
, /PRNewswire/ — ActiveState today announced a reselling partnership with Docker, Inc., the trusted platform for building software in the agentic era. The partnership pairs Docker Hardened Images (DHI), the hardened foundation for enterprise containers, with ActiveState’s trusted open source components. The two companies will jointly go to market and resell each other’s offerings. Enterprises can source a hardened base image from Docker, and the remediated open source packages that run on it from ActiveState, through a single vendor relationship, securing the whole container without slowing developers down.
Containers are the default unit of modern software delivery, and a hardened base image is now the foundation security teams expect them to be built on. The open source that runs on top of that foundation needs the same protections. In ActiveState’s 2026 State of Vulnerability Management and Remediation Report, a survey of 250 North American DevSecOps leaders found that 91% cited limited visibility into container components as their biggest security blind spot, while 90% said their teams still run lightly modified public images with little to no hardening. At the same time, 98% ranked hardened images a high priority, spotlighting a gap between what security teams want and the protections they have in place. Docker Hardened Images address that gap at the foundation. ActiveState addresses it for the open source on top.
“This partnership closes the gap most security teams still live with,” said Abby Kearns, Chief Executive Officer of ActiveState. “Even teams that have hardened the base are still running unverified open source on top of it. Docker secures the image. ActiveState secures what runs on it, in the container and everywhere else, built from source with the provenance to prove it. Together, that gives enterprises one standard for trust, from the base image to every open source component running on it.”
How the partnership works
Docker Hardened Images are the hardened foundation for the container, providing over 4,000 secure-by-default, minimal images built from source and drop-in compatible with Alpine and Debian, with near-zero CVE, signed SBOMs, and SLSA Build Level 3 provenance. The catalog is free and open source under Apache 2.0, and DHI Select and DHI Enterprise add SLA-backed CVE remediation, FIPS and STIG variants, and secure customization. ActiveState provides the secure, trusted open source that runs on that base and beyond it: components across 10 language ecosystems, from modern languages like Python, JavaScript, and Java to long-lived enterprise stacks like Perl, built from source within SLSA Level 3 infrastructure and continuously remediated against contractual SLAs, delivered into the package managers, pipelines, IDEs, and AI coding tools teams already use. Docker Hardened Images are the foundation. ActiveState hardens the open source built on that foundation, and in every application, service, and script that never ships as a container at all.
What joint customers get
- One trusted supply chain, from the hardened base to the open source on top: Docker Hardened Images as the foundation of the container, with ActiveState’s open source in the container and everywhere else it runs,rather than sourced and reconciled separately.
- Provenance that lines up on both sides: SLSA Build Level 3 provenance and signed SBOMs from Docker Hardened Images and SLSA Level 3 build infrastructure from ActiveState, for a consistent evidence trail across the software supply chain.
- Measurable risk reduction without a velocity tax: Docker Hardened Images deliver near-zero CVEs and up to a 95% smaller attack surface, with a 7-day SLA on critical and high CVEs for production workloads. ActiveState components show roughly 95% fewer CVEs and 90% faster remediation than community open source, against an industry-average time to remediate that runs upwards of 140 days. ActiveState is backed by contractual SLAs of 5 business days for critical vulnerabilities, predicated on an upstream community fix existing.
“Docker Hardened Images are the foundation enterprises trust to build secure software: more than 4,000 minimal images, built from source, with signed SBOMs and SLSA Build Level 3 provenance,” said Leon Jones, VP of Partnerships and Alliances at Docker, Inc. “ActiveState’s remediated open source components build on that foundation. Customers get a hardened base from Docker and vetted open source on top, with provenance they can verify at every layer, and their developers keep shipping at speed.”
Availability
The Docker and ActiveState reselling partnership is available now. Enterprises can engage either company to scope joint coverage for their container estate and the rest of their open source footprint.
About ActiveState
ActiveState secures the software supply chain at the source for the AI coding era. With the ActiveState Curated Catalog, a private, vetted repository of open source components, security teams decide what gets into enterprise software before developers or AI coding assistants pull it in. Security gets control, and engineering keeps its speed. The Curated Catalog works with the artifact repositories, scanners, and AI coding assistants that teams already use. Learn more at activestate.com.
About Docker
Docker is the platform at the center of how intelligent software gets built. For more than a decade, Docker has helped millions of developers and thousands of organizations build, ship, and run software consistently across any environment. Today, Docker is extending that same trust to the AI era, giving builders and organizations the confidence to adopt any model, tool, or agent without compromising security, governance, or control. Learn more at www.docker.com.
Media contact
Brandy Coulsey
Brand and Communications Manager
ActiveState
[email protected]
SOURCE ActiveState
