What are hardened container images, actually?
A plain-English explainer on hardened container images, distroless bases, CVE reduction, and why the market suddenly has eight vendors selling them.
A hardened container image is a base image rebuilt from source with the attack surface stripped down to what your workload actually runs. No package manager. No shell you didn't ask for. No dormant CVEs from libraries you don't import.
Why the market exploded
Three things happened in eighteen months. Docker Scout started scoring public images. FedRAMP guidance began citing image provenance. And Chainguard proved a company could charge $50k+ per image tier and close enterprise deals on it. Every hyperscaler and CNAPP vendor now has a hardened-images SKU.
What "hardened" actually means
Look for four things on any vendor page:
- Rebuilt daily from upstream source, not patched binaries.
- SLSA build provenance and signed SBOMs, not just a CVE report.
- A published CVE window — how fast do critical CVEs get patched?
- Root-optional runtime, so your workload isn't running as
uid 0.
Everything else is packaging.