CNCF, Docker Partnership Streamlines Container Security, Operations
The Cloud Native Computing Foundation (CNCF) announced a partnership with Docker aimed at providing CNCF-hosted projects with enhanced security, scalability, and operational support.
Through Docker’s Sponsored Open Source (DSOS) program, all CNCF projects will gain access to trusted container distribution, vulnerability scanning and usage insights designed to make running production-grade open source software more reliable.
The DSOS program unlocks a set of premium capabilities for open source projects, including unlimited image pulls from Docker Hub, secure automated builds from source, access to Docker Scout for vulnerability analysis and policy enforcement, usage metrics, and a DSOS badge that improves visibility and trust with users.
Docker Hub remains the world’s largest container registry, supporting over 22 billion image downloads per month and hosting more than 14 million images.
Chris Aniszczyk, CTO of CNCF, says the partnership is designed to reduce operational burden on open source maintainers.
“It’s about helping reduce friction for our maintainers,” he says. “Unlimited image pulls, secure automated builds, and visibility via Docker Hub’s DSOS badge all make it easier to operate projects at production scale.
He calls it a “small operational shift with a big multiplier effect” to help maintainers focus on innovation rather than infrastructure overhead.
Pasha Finkelshteyn, developer advocate at BellSoft, calls the partnership is a “very practical win” for maintainers.
“Expect smoother, more reliable delivery pipelines and better rate limits. A path to safer, reproducible releases,” he says. “In short, maintainers get more time to focus on innovation instead of firefighting infrastructure issues.”
Enhancing Security and Supply Chain Trust
Security has become a central issue in the open source ecosystem as software supply chain attacks have risen in frequency and impact. Integrating Docker Scout into CNCF projects brings automated vulnerability detection directly into the development workflow.
“Docker Scout brings proactive security into the workflow in a way that aligns with how cloud native teams actually build software,” Aniszczyk says.
For CNCF projects, that means maintainers can surface vulnerabilities early, enforce policies consistently, and make informed decisions about dependencies.
“It’s not just about shifting left, it’s about making security a natural part of the development rhythm,” he says.
By ensuring container images have clear provenance and are continuously monitored for security issues, the collaboration aims to give enterprises more confidence in running CNCF projects in production environments.
“Enterprises count on CNCF projects to be not only stable and secure but also scalable,” Aniszczyk says. “By partnering with Docker, we’re reinforcing that foundation in offering clearer provenance for container images and ensuring access to trusted tooling.
He explains that this gives enterprise users greater confidence when running cloud native workloads in production.
Finkelshteyn says Docker Scout brings security, which means for CNCF projects, maintainers and contributors can proactively identify vulnerabilities before they ever reach end users.
“From a DevSecOps point of view, it’s clear — safer images, safer users and a safer Docker Hub ecosystem,” he explains. “Security isn’t an afterthought anymore; it becomes a default part of open source delivery.”
Driving Data-Informed Project Roadmaps
One of the most valuable benefits of the partnership for maintainers may be access to usage data and engagement insights from Docker Hub.
These metrics can shed light on how widely CNCF projects are adopted, where container images are pulled from, and which versions are most used in the wild.
“Access to Docker hub usage data offers our maintainers a window into how their work is being used,” Aniszczyk says. “This looks like seeing what images are popular, where they are pulled from, and how usage trends evolve.
This kind of insight can inform roadmaps, priorities, and documentation improvements.
“It’s about closing the feedback loop between users and maintainers, which makes the CNCF ecosystem more responsive and resilient,” he says.
By combining operational tooling with actionable insights, the DSOS program helps maintainers prioritize development efforts based on real-world usage rather than guesswork.
Finkelshteyn points out that business and technology decisions are data-driven.
“With Docker Hub insights, maintainers can now understand not just how many people use their projects, but even more importantly, where,” he says. “This empowers maintainers to guide roadmaps with a clearer picture of community and trends.”
Broader Implications for the Cloud Native Ecosystem
For CNCF, which hosts some of the most widely used open source projects in the world — including Kubernetes, Prometheus, Envoy, and OpenTelemetry — ensuring the reliability and security of its ecosystem is a top priority.
The partnership with Docker reflects a growing recognition that open source projects are critical infrastructure and need enterprise-grade operational support.
“All CNCF projects are eligible for enrollment and can receive a DSOS badge on Docker Hub, making it clear to users which images are trusted,” CNCF said in its announcement.
Aniszczyk views the collaboration as part of a longer-term effort to strengthen the foundation of cloud native software, calling the partnership “just the beginning”.
He adds Docker and CNCF share a common goal: to empower open source developers and maintainers.
“As the cloud native ecosystem continues to mature and as AI development rapidly accelerates, this collaboration may evolve and will continue to reflect this collective mission,” he says.
