ActiveState Allies with Docker to Harden Software Artifacts
TL;DR — Key Takeaways
- ActiveState and Docker are partnering to secure enterprise containers. The companies will resell each other’s offerings, combining Docker’s hardened base images with ActiveState’s remediated open source libraries.
- Container security requires protection across every layer. Hardened base images help reduce risk, but application dependencies also need ongoing monitoring, patching and verification.
- Adoption still trails security priorities. An ActiveState survey found 90% of surveyed DevSecOps leaders said their teams run lightly modified public images with little to no hardening, despite 98% ranking hardened images a high priority.
ActiveState and Docker, Inc. today revealed they will both resell the hardened libraries and images that each company curates.
The overall goal is to make it simpler for application development teams to source both hardened container images and the libraries they run on that are certified using Level 3 of the Supply-chain Levels for Software Artifacts (SLSA) framework.
ActiveState CEO Abby Kearns said the alliance creates an ecosystem around a set of hardened open source software artifacts to better secure software supply chains. Docker has also already curated more than 4,000 hardened images while ActiveState provides access to a large number of libraries spanning 10 programming languages. The company also provides a service level agreement (SLA) through which it makes a hardened library available within five days of an upstream fix to a vulnerability in an open source project being made.
It’s not clear how quickly organizations are moving to secure their software supply chains, but in the artificial intelligence (AI) era, the rate at which cybercriminals are able to reverse engineer a vulnerability to create an exploit has been reduced to a matter of hours. On top of that, malicious actors are increasingly leveraging AI to now launch cyberattacks at machine speed.
In the absence of a repository that makes it simpler for developers to access hardened images and libraries, it’s become much more likely that a vulnerability discovered in a production environment will be exploited.
Unfortunately, not enough organizations are proactively moving to mitigate those threats to their software supply chains, said Kearns. A recent ActiveState survey finds 91% of application development teams have limited visibility into container components, with 90% still running lightly modified public images with little to no hardening.
It will probably require more or more catastrophic events involving a breach of a known vulnerability before software engineering teams are directed to spend more time on securing existing applications versus continuing to develop new applications or add features to existing applications, said Kearns. On the plus side, however, nearly all survey respondents (98%) identified adoption of hardened images as a high priority.
In the meantime, however, the amount of potentially vulnerable code being deployed in the age of AI coding is only increasing. A separate ActiveState survey finds that as organizations rely more on AI coding tools to build applications, they are simultaneously increasing the amount of open source software they are dependent on. Specifically, the survey finds 89% of respondents work for organizations that are using AI coding tools in production environments. Among those respondents, 94% are using more open source software as a result, largely because it is much more readily accessible. The challenge is that AI models are now surfacing more vulnerabilities in open source software than ever.
Mitch Ashley, vice president and practice lead for software lifecycle engineering for the Futurum Group, said thoroughly hardening images and libraries takes sustained engineering work. Teams have to track every dependency, rebuild on each upstream fix, and prove provenance. Few application teams can staff that, and the patch cycle keeps shrinking as AI cuts the time from disclosure to exploit, he added.
Deploying hardened artifacts moves that work to suppliers, but the challenge is whether ActiveState and Docker can maintain their rebuild and patch velocity ahead of the exploit window, said Ashley.
At this juncture, the concern is less about whether a vulnerability will be exploited than how to reduce the number of incidents that might occur. The more hardened images and libraries that have been deployed, the fewer the number of incidents there should ultimately be.
Frequently Asked Questions
What does the ActiveState–Docker partnership provide?
Organizations can obtain Docker Hardened Images and ActiveState’s remediated open source components through a single vendor relationship, simplifying procurement and software supply chain security.
Why aren’t hardened base images enough?
Applications add libraries and other dependencies on top of a base image. Those components can introduce vulnerabilities and require their own security checks and updates.
How does SLSA support this approach?
Docker provides SLSA Build Level 3 provenance, while ActiveState builds components within SLSA Level 3 infrastructure. These practices help organizations verify how software artifacts were built and protect against build tampering.
