News
What happened
Docker has enhanced its Hardened Images by integrating with Aikido, enabling built-in VEX support for vulnerability scanning. This integration helps developers prioritize actionable findings by filtering out non-exploitable vulnerabilities.
The new integration between Docker Hardened Images (DHI) and Aikido introduces built-in VEX support, streamlining the vulnerability scanning process. By automatically filtering out vulnerabilities that Docker has verified as non-exploitable, developers can focus on genuine threats. This enhancement is particularly beneficial for teams overwhelmed by the increasing volume of CVEs, allowing them to maintain a more secure and efficient workflow.
Release at a glance
Key facts from the announcement.
Product
Docker Hardened Images
Integration
Aikido
Feature
Built-in VEX support
REMOTE ACCESS
Protect Your Admin Sessions
A zero-exposure architecture secures your server. A VPN secures you — encrypting your connection when managing infrastructure from untrusted networks, coffee shops, or travel. NordVPN is what we use for this layer.
Try NordVPN →This is an affiliate link. If you purchase, I earn a commission at no extra cost to you.
Changes at a glance
What's new
The integration of Aikido with Docker Hardened Images introduces built-in VEX support, which filters out vulnerabilities that are non-exploitable. This allows teams to focus on actionable findings, significantly reducing the number of CVEs they need to triage.
Additionally, Aikido utilizes signed SBOMs to provide complete component data without the need to index a distroless filesystem, enhancing the accuracy of vulnerability assessments.
Breaking changes
No breaking changes were reported in the source material.
Analysis
In detail
Aikido now scans Docker Hardened Images with built-in VEX support, which allows it to automatically drop vulnerabilities verified as non-exploitable by Docker. This integration aims to reduce the noise in vulnerability triage, enabling developers to concentrate on significant findings that require attention.
To utilize this feature, users need an active Aikido account, access to Docker Hardened Images, and a Docker Hub Personal Access Token with read-only scope. Once connected, Aikido automatically detects and scans DHI images without requiring additional configuration, leveraging signed SPDX 2.3 SBOMs for accurate component data.
The integration follows a structured workflow: Aikido detects the DHI base image, catalogs the signed SBOM, matches components against vulnerability feeds, and applies VEX statements to suppress findings marked as resolved. This results in a significantly reduced active queue of vulnerabilities, allowing teams to focus on real issues while maintaining compliance with audit requirements.
Key takeaways
The most important facts from this update.
Why it matters
This integration is crucial for self-hosters and homelab builders who rely on Docker Hardened Images to minimize their attack surface. By streamlining vulnerability management, teams can enhance their security posture while saving valuable time and resources.
Homelab impact
Homelab operators using Docker Hardened Images will benefit from the enhanced vulnerability scanning capabilities provided by Aikido. The automatic filtering of non-exploitable vulnerabilities means that users can spend less time triaging irrelevant findings, allowing them to focus on genuine security issues.
For those managing multiple applications and services, this integration simplifies the vulnerability management process, making it easier to maintain compliance and security across their infrastructure. Users should ensure they have the necessary accounts and tokens set up to take full advantage of this new feature.
What to do next
Practical steps for operators running self-hosted stacks.
This article summarises reporting from Docker Blog. Visit the original post for release notes, changelogs, and full technical documentation.