Make zero CVEs your new default

Docker announced two connected changes aimed at the same problem: supply-chain visibility and package-level security. The first is SIEM streaming in Docker AI Governance, which sends every policy decision triggered by AI agents to the SIEM your security team already operates, with a searchable record stored in Docker Cloud. The second is Docker Hardened System Packages, which pushes hardening below the image layer to the individual packages inside it, covering both Alpine and Debian distributions.

The package hardening works by building every package from upstream source, patching it, and maintaining it in the same SLSA Build Level 3 pipeline that builds Docker Hardened Images. Docker patches at the package level rather than waiting for distribution release cycles, and a fix lands across every image using that package in a single build wave. The Debian and Alpine package lists are public, so teams can track what has been hardened. Python is among the first Debian images to ship fully hardened, and the catalog has grown past 4,000 images with over 3.5 million pulls per week.

Adoption costs are deliberately low for the image catalog. Docker Hardened Images are free for every developer, compatible with Alpine and Debian, and switching is a FROM-line change rather than a migration. Every image carries signed SBOMs and SLSA Build Level 3 provenance. For DHI Enterprise customers, the hardened package repository is available beyond the catalog: teams can point apt or apk directly at Docker's repository and bring the same hardened packages into images they build themselves, extending the supply chain guarantees to custom images.

The SIEM streaming feature addresses a gap created by AI agents pulling dependencies at machine speed. The searchable record in Docker Cloud shows both what agents did and what policy stopped them from doing, giving security teams an audit trail without introducing a new tool. Policy enforcement now also reaches every developer machine, not just CI or production environments.

The material does not specify pricing for DHI Enterprise, the full list of supported packages, or which SIEM integrations are available beyond the general claim of streaming to the SIEM your team already runs. Security coverage continues after software reaches end of life through ELS images, but the scope of that extended coverage is not detailed. The claims about adoption numbers and threat landscape shifts come from Docker's own announcement and are not corroborated by independent feeds, since only one feed carried this event.