Monat: Oktober 2025

Unlimited access to Docker Hardened Images: Because security should be affordable, always

Every organization we speak with shares the same goal: to deliver software that is secure and free of CVEs. Near-zero CVEs is the ideal state. But achieving that ideal is harder than it sounds, because paradoxes exist at every step. Developers patch quickly, yet new CVEs appear faster than fixes can ship. Organizations standardize on open source, but every dependency introduces fresh exposure. Teams are asked to move at startup speed, while still delivering the assurances expected in enterprise environments.

The industry has tried to close this gap and chase the seemingly impossible goal of near-zero CVEs. Scanners only add to the challenge, flooding teams with alerts more noise than signal. Dashboards spotlight problems but rarely deliver solutions. Hardened images hold real promise, giving teams a secure starting point with container images free of known vulnerabilities. But too often, they’re locked behind a premium price point. Even when organizations can pay, the costs don’t scale, leaving uneven protection and persistent risk.

That changes today. We’re introducing unlimited access to the Docker Hardened Images catalog, making near-zero CVEs a practical reality for every team at an affordable price. With a single Hardened Images subscription, every team can access the full catalog: unlimited, secured, and always up to date. Logged in users will be able to access a one-click free trial, so teams can see the impact right away.

This launch builds on something we’ve done before. With Docker Hub, we made containers accessible to every developer, everywhere. What was once complex, niche, and difficult to adopt became simple and universal. Now, Docker can play that same role in securing the ecosystem.Every developer’s journey, whether they realize it or not, often begins with Docker Hub, and the first step in that journey should be secure by default, with hardened, trusted images accessible to everyone, without a premium price tag.

What makes Docker Hardened Images different

Unlimited access to the Docker Hardened Images catalog isn’t just another secure image library, it’s a comprehensive foundation for modern development. The catalog covers the full spectrum of today’s needs: ML and AI images like Kubeflow, languages and runtimes such as Python, databases like PostgreSQL, application frameworks like NGINX, and core infrastructure services including Kafka.It even includes FedRAMP-ready variants, engineered to align out of the box with U.S. federal security requirements. 

What truly sets Docker Hardened Images apart is our hardening approach. Every image is built directly from source, patched continuously from upstream, and hardened by stripping away unnecessary components. This minimal approach not only reduces the attack surface but also delivers some of the smallest images available, up to 95% smaller than alternatives. Each image also includes VEX (Vulnerability Exploitability eXchange) support, helping teams cut through noise and focus only on vulnerabilities that truly matter.

Docker Hardened Images is compatible with widely adopted distros like Alpine and Debian. Developers already know and trust these, so the experience feels familiar and trusted from day one. Developers especially appreciate how flexible the solution is: migrating is as simple as changing a single line in a Dockerfile. And with customization, teams can extend hardened images even further, adding out-of-the-box system packages, certifications, scripts, and tools without losing the hardened baseline.

And this isn’t just our claim. The quality and rigor of Docker Hardened Images were independently validated by SRLabs, an independent cybersecurity consultancy, who confirmed that the images are signed, rootless by default, and ship with SBOM + VEX. Their assessment found no root escapes or high-severity breakouts, validated Docker’s 95% reduction in attack surface, and highlighted the 7-day patch SLA and build-to-sign pipeline as clear strengths over typical community images.

Making security universal

By making hardened, trusted images accessible to everyone, we ensure every developer’s journey begins secure by default, and every organization, from startups to enterprises, can pursue near-zero CVEs without compromise.

Talk to us to learn more

Explore how Docker Hardened Images is a good fit for every team 

Start a on-click free 30 day trial (requires Hub login) to see the difference for yourself

Quelle: https://blog.docker.com/feed/

IBM Granite 4.0 Models Now Available on Docker Hub

Developers can now discover and run IBM’s latest open-source Granite 4.0 language models from the Docker Hub model catalog, and start building in minutes with Docker Model Runner. Granite 4.0 pairs strong, enterprise-ready performance with a lightweight footprint, so you can prototype locally and scale confidently.

The Granite 4.0 family is designed for speed, flexibility, and cost-effectiveness, making it easier than ever to build and deploy generative AI applications.

About Docker Hub

Docker Hub is the world’s largest registry for containers, trusted by millions of developers to find and share high-quality container images at scale. Building on this legacy, it is now also becoming a go-to place for developers to discover, manage, and run local AI models. Docker Hub hosts our curated local AI model collection, packaged as OCI Artifacts and ready to run. You can easily download, share, and upload models on Docker Hub, making it a central hub for both containerized applications and the next wave of generative AI.

Why Granite 4.0 on Docker Hub matters

Granite 4.0 isn’t just another set of language models. It introduces a next-generation hybrid architecture that delivers incredible performance and efficiency, even when compared to larger models.

Hybrid architecture. Granite 4.0 cleverly combines the linear-scaling efficiency Mamba-2 with the precision of transformers. Select models also leverage a Mixture of Experts (MoE) strategy – instead of using the entire model for every task, it only activates the necessary “experts”, or subssets of parameters. This results in faster processing and memory usage reductions of more than 70% compared to similarly sized traditional models.

“Theoretically Unconstrained” Context. By removing positional encoding, Granite 4.0 can process incredibly long documents, with context lengths tested up to 128,000 tokens. Context length is limited only by your hardware, opening up powerful use cases for document analysis and Retrieval-Augmented Generation (RAG).

Fit-for-Purpose Sizes. The family includes several sizes, from the 3B parameter Micro models to the 32B parameter Small model, allowing you to pick the perfect balance of performance and resource usage for your specific need

What’s in the Granite 4.0 family

Sizes and targets (8-bit, batch=1, 128K context):

H-Small (32B total, ~9B active): Workhorse for RAG and agents; runs on L4-class GPUs.

H-Tiny (7B total, ~1B active): Latency-friendly for edge/local; consumer-grade GPUs like RTX 3060.

H-Micro (3B, dense): Ultra-light for on-device and concurrent agents; extremely low RAM footprint.

Micro (3B, dense): Traditional dense option when Mamba-2 support isn’t available.

In practice, these footprints mean you can run capable models on accessible hardware – a big win for local development and iterative agent design.

Run in seconds with Docker Model Runner

Docker Model Runner gives you a portable, reproducible way to run local models with an OpenAI-compatible API from laptop dev to CI and cloud.

# Example: start a chat with Granite 4.0 Micro
docker model run ai/granite-4.0-micro

Prefer a different size? Pick your Granite 4.0 variant in the Model Catalog and run it with the same command style. See the Model Runner guide for enabling the runner, chat mode, and API usage.

What you can build (fast)

Granite’s lightweight and versatile nature makes it perfect for a wide range of applications. Combined with Docker Model Runner, you can easily build and scale projects like:

Document Summarization and Analysis: Process and summarize long legal contracts, technical manuals, or research papers with ease.

Smarter RAG Systems: Build powerful chatbots and assistants that pull information from external knowledge bases, CRMs, or document repositories.

Complex Agentic Workflows: Leverage the compact models to run multiple AI agents concurrently for sophisticated, multi-step reasoning tasks.

Edge AI Applications: Deploy Granite 4.0 Tiny in resource-constrained environments for on-device chatbots or smart assistants that don’t rely on the cloud.

Join the Open-Source AI Community

This partnership is all about empowering developers to build the next generation of AI applications. The Granite 4.0 models are available under a permissive Apache 2.0 license, giving you the freedom to customize and use them commercially.

We invite you to explore the models on Docker Hub and start building today. To help us improve the developer experience for running local models, head over to our Docker Model Runner repository.

Head over to our GitHub repository to get involved:

Star the repo to show your support

Fork it to experiment

Consider contributing back with your own improvements

Granite 4.0 is here. Run it, build with it, and see what’s possible with Granite 4.0 and Docker Model Runner.
Quelle: https://blog.docker.com/feed/