ActiveState and Docker Partner to Strengthen Open Source Security in Enterprise Containers

ActiveState and Docker have announced a reselling partnership aimed at enhancing the security of open-source components within enterprise container deployments. The collaboration will see Docker Hardened Images (DHI) paired with ActiveState's curated open-source packages, allowing enterprises to procure both through a single vendor relationship. This initiative directly responds to findings from ActiveState's 2026 State of Vulnerability Management and Remediation Report, which highlighted that 91% of DevSecOps leaders lack sufficient visibility into container components, and 90% still rely on minimally modified public images. This partnership is critical for practitioners because it offers a practical solution to a long-standing problem in DevSecOps: the inherent security risks associated with open-source dependencies and container images. By providing pre-hardened base images and remediated open-source components, the offering aims to reduce the burden on development and security teams. It enables them to build secure applications from the ground up, minimizing the attack surface and mitigating vulnerabilities earlier in the software development lifecycle. The ability to source these critical security components from a single vendor also simplifies procurement and integration, which can be a significant advantage for large enterprises. The move aligns with a broader, well-established trend in DevSecOps focusing on software supply chain security. As organizations increasingly adopt cloud-native architectures and leverage open-source software, the attack surface expands, making the integrity of the software supply chain a top priority. Recent years have seen a surge in supply chain attacks, container vulnerabilities, and misconfigured cloud infrastructure, making it clear that security cannot be an afterthought. This partnership reflects the industry's shift towards "shift smart" security, where context-aware security feedback is integrated directly into developer workflows, and robust dependency management, SBOM generation, and artifact signing become core practices. In practice, this means DevSecOps teams should evaluate how this integrated offering can fit into their existing workflows. It presents an opportunity to standardize on more secure base images and ensure that open-source dependencies are continuously monitored and remediated. Practitioners should look for ways to automate the consumption of these hardened components within their CI/CD pipelines. This could involve updating their image build processes to utilize DHIs and integrating ActiveState's offerings for dependency management. Furthermore, this partnership highlights the need for continuous vulnerability monitoring and policy enforcement at every stage of the software development lifecycle, from pre-commit hooks to runtime protection. Organizations should also consider the implications for their overall software bill of materials (SBOM) generation and attestation processes, as a more secure foundation simplifies compliance and auditing.