Changelog Master Feed Setting Docker Hardened Images free (Changelog Interviews #675)
27 snips
Feb 4, 2026 
Tushar Jain, EVP of Engineering at Docker who led the Hardened Images initiative, discusses making secure, minimal production images open and free. They talk about supply-chain security, SBOMs and VEX annotations. Conversation covers the new build system, migration trade-offs, adoption after the free release, and plans for secure runtimes and AI agent guardrails.
AI Snips
Chapters
Transcript
Episode notes
Make Secure Images The Default
- Docker recognized that minimizing image surface area and faster upstream patching reduce supply-chain risk significantly.
- Hardened images combine minimal packages, faster patching, SBOMs, SALSA provenance, and signing to make images more secure by default.
Three Pillars Of Image Trust
- SBOMs, SALSA build provenance, and VEX disclosures form the foundational guarantees for trusted images.
- Docker enforces SALSA-level reproducible builds and publishes VEX statements to reduce scanner noise while remaining transparent.
Use Multi-Stage Builds For Safer Production
- Use multi-stage builds and separate dev vs production images to keep production images minimal and safer.
- If you need extra packages, add them via a hardened build pipeline so SBOMs and provenance remain intact.