Docker Hardened Images alternatives

In brief

• The free Community tier is real: Alpine and Debian images, SBOMs, provenance and signatures, usable in production, with no CVE fix SLA.
• It stops at four points: no Ubuntu or Red Hat UBI, no SLA on the free tier, FIPS and STIG only on paid tiers, and a Docker login on pulls.
• Compare any alternative on the same eight criteria, and for Ubuntu or Red Hat shops start with the providers that keep those distributions.

Docker Hardened Images (DHI) became free under the Apache 2.0 license on December 17, 2025. The free Community tier covers Alpine- and Debian-based images with SBOMs, SLSA Build Level 3 provenance, OpenVEX statements and signatures, and Docker says it may be used in production. A critical CVE fix SLA, FIPS and STIG variants and customization sit on the paid Select and Enterprise tiers, and Extended Lifecycle Support is a paid add-on that requires Enterprise (October 20, 2026). This guide sets out what the free tier does and does not give you, what to compare, and how the alternatives, RapidFort included, measure on the same criteria.

What Docker Hardened Images include, free and paid

Docker's own page and FAQ list three tiers, as of October 2026. Community: the full catalog, free, with SBOMs, SLSA Build Level 3 provenance, OpenVEX and signatures, usable in production, with no CVE fix SLA. Select: starting at 5,000 US dollars per repository, adds a critical CVE SLA of under 7 days, FIPS and STIG variants and up to five customizations. Enterprise: by quote, adds unlimited customization, a hardened system packages repository and eligibility for Extended Lifecycle Support, which continues hardened updates for up to five years after upstream end of life. Images are built on Alpine and Debian, and Docker says migration is designed to be as simple as changing one line in a Dockerfile.

Where the free tier is enough, and where it stops

DHI Community is enough when your services run on Alpine or Debian, you need no contractual fix window, no FIPS or STIG variant and no customization, and a Docker login on pulls is acceptable. It stops being enough at four points. Distribution: there is no Ubuntu or Red Hat UBI; teams on those distributions would move operating systems, which means a full rebuild and test pass, and Alpine Linux is built around musl libc and busybox, so test anything that depends on the C library. SLA: the free tier has none, so a critical CVE is fixed when Docker fixes it. Compliance: FIPS and STIG variants are paid, so the price for workloads that need those variants is the Select or Enterprise price, not zero. Access: Docker's quickstart has you sign in with a Docker account (docker login dhi.io) before pulling Community images.

The eight criteria to compare

The same eight criteria apply to any hardened image provider. Base distribution and compatibility. Migration effort: drop-in or Dockerfile rewrite. CVE patch windows, with the time unit, the clock start, whether there is a separate window for CISA Known Exploited Vulnerabilities, and whether it is contractual. Catalog coverage for the images you run, counted the same way across vendors. FIPS and STIG variants and the benchmark behind them. Scanner compatibility, SBOM and VEX. Free tier terms and production rights. Pricing model, price history and vendor stability. The full explanation of each criterion is in the companion guide. Chainguard alternatives

The alternatives

RapidFort Images

RapidFort Images are built on all major LTS releases of Ubuntu, Debian and Red Hat, plus Alpine, including minor and older versions, which covers the two distributions DHI does not. They are drop-in replacements, pin-for-pin compatible with no re-baselining: the same distributions and tags, with environment variables and paths unchanged. RapidFort engineers manually patch and rebuild them, and every image is continuously patched to eliminate all CVEs for which a patch is available, with up to 99.9% CVE elimination across distroless and full images.

Patch windows: CISA KEV 1 day, Critical and High 7 days, Moderate 21 days, Low 28 days, from when a patch is available. Images are hardened against their appropriate STIG or CIS Benchmark, when available, and FIPS and standard variants are available unless an image does not need one or upstream licensing prevents it. They carry rich metadata, work with every major scanner and are registry flexible, with CycloneDX and VEX on the Full Catalog plan. The catalog holds tens of thousands of images. Plans are at rapidfort.com/pricing, including a free tier.

Chainguard

Chainguard builds its images on its own distribution, Chainguard OS. Its pricing page lists a free tier of five images that are not covered by its CVE remediation SLA and a Containers Catalog starting at 19,000 US dollars for a team of 10, with an SLA of 7 days for critical CVEs and 14 days for all others, plus a 1-day KEV SLA (October 20, 2026). Its migration guide says Dockerfiles built on Debian, Ubuntu or Red Hat UBI need their package commands adapted to apk. Chainguard alternatives

Bitnami Secure Images

Bitnami Secure Images, from Broadcom, are built on a Photon OS base. Broadcom says a portion of the catalog is free for non-production use in the latest tag only and that pricing is through sales, and it lists FIPS and STIG support (October 20, 2026).

Iron Bank

Iron Bank is a secure container image repository within Platform One that provides hardened containers for the US Department of Defense, and there is currently no cost to contributors or users. Its FAQ states it "does not authorize or approve containers at this time" and that it provides an assessment teams use to obtain their own authorization. It is built for defense programs, and pulling images requires a Registry1 account.

Google Distroless

An open source project in the GoogleContainerTools organization on GitHub whose images contain only your application and its runtime dependencies. Images are based on Debian 13 and track Debian on its standard support timeline; the repository publishes no SLA.

Building your own

In-house hardening means tracking advisories, backporting, rebuilding, testing and distributing for every base, continuously. It suits teams with few bases and dedicated staff; the fix window is whatever the team sustains.

Comparison table

As of October 20, 2026; each cell from the named vendor's own page.

How to migrate between providers without breaking builds

Change the FROM line, keep everything else, and test. If the new image keeps your distribution and tags, the change is the registry and image name and the test pass is the one you run for any base image update. If the new image changes the distribution, plan a full rebuild and regression pass and check anything that depends on glibc, locale or DNS behavior. Pin the new image by digest, scan it with your own scanner before and after the change, and enforce the approved registry at admission so no service drifts back.

Frequently asked questions