The Changelog: Software Development, Open Source Setting Docker Hardened Images free (Interview)
10 snips
Feb 4, 2026 
Tushar Jain, EVP of Engineering at Docker and lead for supply chain security, describes Docker Hardened Images and the motivations behind them. He walks through SBOMs, VEX statements, reproducible builds, and how hardened images reduce scanner noise. They discuss developer trade-offs, adoption, roadmap, and plans for secure runtimes and AI agent safety.
AI Snips
Chapters
Transcript
Episode notes
Secure Images As A Foundational Layer
- Docker positioned hardened images to minimize attack surface by shipping minimal, well-patched base and app images.
- They built a reproducible SALSA v3 build pipeline and signed SBOMs to ensure provenance and faster patching.
Transparency Over Green Scanning
- Docker enforces SBOMs, build provenance (SALSA), and VEX statements to be transparent about vulnerabilities and exploitability.
- This transparency avoids suppressing CVEs and helps scanners and CISOs make informed decisions.
Prefer Minimal Images And Multi-Stage Builds
- Start with minimal hardened images and use multi-stage builds to keep production artifacts small.
- Migrate dev images only when you accept trade-offs around debug tools and shell access in production.