Vancouver, British Columbia, October 22 /PRNewswire/ — ActiveState today announced a reseller partnership with Docker, Inc., a company recognized as “the trusted platform for building software in the agent era.” This collaboration combines Docker Hardened Images (DHI)—the hardened foundation for enterprise containers—with ActiveState’s trusted open source components. The two companies will jointly market and resell each other’s products. Enterprises can secure their entire container stack without slowing down developers by obtaining hardened base images from Docker and patched open source packages from ActiveState through a single vendor relationship.
Containers have become the default unit of modern software delivery, and hardened base images are now what security teams expect as the foundation for their builds. Open source software running on this foundation requires the same level of protection. According to ActiveState’s 2026 State of Vulnerability Management and Remediation report, which surveyed 250 DevSecOps leaders in North America, 91% cited limited visibility into container components as their biggest security blind spot, and 90% reported that their teams continue to use lightly modified public images with little to no hardening. Meanwhile, 98% ranked hardened images as a high priority, revealing a gap between security teams’ needs and current protections. Docker Hardened Images are designed specifically to address this foundational gap, while ActiveState tackles the security of open source software built on top.
Abby Kearns, CEO of ActiveState, said: “This partnership addresses the gap that most security teams still face. Even after teams have hardened the foundational layer, they continue to run unverified open-source software on top. Docker secures the images; ActiveState secures what runs on top—whether inside containers or elsewhere—by building from source and providing provable provenance. Together, they deliver a unified trust standard for enterprises, from the base image to every open-source component.”
How does cooperation work?
Docker Hardened Images serve as a hardened foundation for containers, offering over 4,000 default-secure, minimal images built from source code and compatible with Alpine and Debian, enabling direct replacement with near-zero CVEs, signed SBOMs, and SLSA Build Level 3 provenance. This catalog is freely open-source under the Apache 2.0 license, while DHI Select and DHI Enterprise add SLA-backed CVE remediation, FIPS and STIG-compliant versions, and security customization features. ActiveState provides secure, trusted open source that runs on top of this foundation—and across a broader ecosystem—covering components from 10 language ecosystems, including modern languages like Python, JavaScript, and Java, as well as long-standing enterprise technologies like Perl, all built from source within SLSA Level 3 infrastructure and continuously patched under contractual SLAs, delivered directly into the package managers, pipelines, IDEs, and AI-powered coding tools teams are already using. Docker Hardened Images form the foundation. ActiveState hardens the open source software built on top of it, as well as open source components within applications, services, and scripts that are never delivered as containers.
What benefits do joint customers receive?
- A trusted supply chain: Docker Hardened Images serve as the container foundation, while ActiveState provides open-source software within the container and other running environments—eliminating the need to procure and integrate components separately.
- Consistent provenance across both ends: Docker Hardened Images provide SLSA Build Level 3 provenance and signed SBOMs, while ActiveState provides SLSA Level 3 build infrastructure, creating a consistent chain of evidence throughout the software supply chain.
- Significantly reduce risk without sacrificing speed: Docker Hardened Images offer near-zero CVEs and up to 95% smaller attack surfaces, with a 7-day SLA for critical and high-severity CVEs in production workloads. Compared to community open-source, ActiveState components have approximately 95% fewer CVEs and fixes that are 90% faster; industry average fix times often exceed 140 days. ActiveState also provides contractual SLAs: for critical vulnerabilities, fixes are delivered within five business days when patches are already available in the upstream community.
Leon Jones, Vice President of Partnerships and Alliances at Docker, said: "Docker Hardened Images provide a trusted, secure foundation for enterprise software builds: over 4,000 minimal images, built from source, with signed SBOMs and SLSA Build Level 3 provenance. ActiveState’s patched open-source components build upon this foundation. Customers can obtain a hardened base from Docker and layered on top, vetted open-source software, with verifiable provenance at every layer—while developers maintain their delivery speed."
Availability
The reseller partnership between Docker and ActiveState is now available. Enterprises can contact either company to plan a joint coverage solution for their container assets and remaining open-source software footprint.
About ActiveState
ActiveState is committed to securing the software supply chain at the source for the era of AI-powered programming. Through the ActiveState Curated Catalog—a private, vetted repository of open-source components—security teams can determine which components are allowed into enterprise software before they are introduced by developers or AI programming assistants. Security teams gain control, while engineering teams maintain speed. The Curated Catalog integrates seamlessly with the artifact repositories, scanning tools, and AI programming assistants your team is already using. Learn more at activestate.com.
About Docker
Docker is the foundational platform for intelligent software development. For over a decade, Docker has enabled millions of developers and thousands of organizations to consistently build, deliver, and run software in any environment. Today, Docker is extending that same trust into the AI era, empowering builders and organizations to confidently adopt any model, tool, or agent without compromising security, governance, or control. Learn more at www.docker.com.
Media contact
Brandy Coulsey
Brand and Communications Manager
ActiveState
[email protected]