What is DHI?

Why does it matter?

When should you use it?

How does it work?

Security by Default

Full Transparency

Hardened Supply Chain

Developer Friendly

How to Get Started?

1. Authenticate to the DHI Registry

2. Update your Dockerfile

Best Practices: Implementation Strategies

Adopt Multi-Stage Builds

Deep Debugging with "docker debug"

Conclusion Containers have become the core of modern application delivery. But as adoption grows, so does the attack surface. From vulnerable base images to supply chain risks, security is no longer optional—it’s foundational. This is where Docker Hardened Images (DHI) come into play. Docker Hardened Images are minimal, secure, and production-ready container images maintained directly by Docker. They are designed to reduce vulnerabilities from the start while simplifying compliance and integration into existing workflows. Docker Hardened Images features Instead of relying on generic base images and fixing issues later with scanners, DHI focuses on building a secure foundation from the beginning. Docker Hardened Images (DHI) are curated container images built with a strong focus on security, minimalism, and maintainability. They are designed to reduce the number of known vulnerabilities by limiting unnecessary packages and continuously applying patches. Most container vulnerabilities originate from base images. If your foundation is already risky, everything built on top inherits that risk. DHI minimizes this exposure early in the lifecycle. DHI combines multiple security layers: Using DHI doesn’t require additional software installation because it’s integrated directly into the Docker Engine. However, since it uses a specialized registry, you must first authenticate. Open your terminal and run the login command for the official dhi.io registry: You will be prompted for your Docker ID and Personal Access Token (PAT). Ensure your account has access to a Docker tier that supports DHI (Select or Enterprise tiers). Implementation is as simple as updating a single line in your Dockerfile. Just replace your standard image prefix with dhi.io/. Example: Standard Node.js Image Example: Hardened Node.js Image Since DHI images are designed to be extremely minimal—often lacking a shell (like /bin/sh) or a package manager (like apt/apk)—you should adopt the following strategies: DHI is a runtime-optimized image, not a build-time environment. Perform your compilation and dependency installation in a standard "builder" image, then copy only the necessary artifacts into the final DHI layer. Because DHI images lack an interactive shell, docker exec -it will not work by default. Instead, use the new Docker Debug capability to inspect your running containers: DHI represents a shift in how we think about container security. Instead of reacting to vulnerabilities after scanning, DHI helps prevent them from being introduced in the first place—starting from the base image. It doesn’t replace tools like Trivy or other scanners, but it significantly reduces the noise and risk those tools have to deal with. If you’re already building containers, adopting hardened images is one of the lowest-effort, highest-impact improvements you can make. Aight, thanks for taking the time read this post. Happy containerazation 🚀 Templates let you quickly answer FAQs or store snippets for re-use. Hide child comments as well For further actions, you may consider blocking this person and/or reporting abuse