Getty Images

Tip

5 reasons hardened images are seeing a resurgence

Hardened container images reduce software supply chain risk by minimizing vulnerabilities, improving compliance, reducing toil and boosting performance.

Ben Lutkevich
By
Published: 14 Aug 2026

Hardened images are becoming a practical necessity for many organizations running production workloads.

Production workloads incorporate third-party software that enterprise development teams have no control over. Generic containers hold many components that might not be relevant to a given use, but that still introduce a certain level of risk if the software components they contain are compromised. If someone finds a vulnerability in those upstream sources, engineering teams have no direct way to fix it on their own.

Vendors, including BellSoft, Chainguard, Docker, Minimus, Red Hat, RapidFort and Wiz, aim to prevent this issue by providing container images with vulnerabilities already resolved, called hardened images.

In a recent Omdia survey, 77% of respondents said that either third-party and OSS code or software dependencies were the riskiest elements of the software supply chain for cloud-native technology. The same survey found that hardened container images were the only security tools for third-party and OSS code components that more than half of organizations identified as very effective.

Why are hardened container images important now?

Hardened images are not new, but they have become more relevant due to a confluence of factors.

Software supply chains have become more complex, attacks on them have become more common and drawn more attention, and vulnerability discovery has increased in quantity and speed -- in part because of AI. In addition, organizations have historically been focused on removing friction for developers, not adding it with additional security measures.

"It still persists, the idea that you don't create friction in how developers work. They didn't get a lot of security historically" said Katie Norton, analyst at IDC. "I'm meeting more and more companies that when they think about securing AI, the developer use case around that is so prominent because of things like Claude and Cursor and AI coding. The software development process is considered use case number one, just as much as Kathy in HR using ChatGPT when she's not supposed to. The use cases around coding with AI are just so visible that now the priority level has just jumped [several] notches."

What are the features of hardened container images?

The features of hardened images generally include:

  • A base image following security standards that map closely to NIST SP 800-190's container security guidance.
  • A formal record of the components included in the image and supply-chain relationships of the components -- a software bill of materials.
  • Cryptographic provenance ensuring that the image was not tampered with.
  • A commitment from the image provider or vendor to minimize exposure to vulnerabilities, and to remediate and republish images quickly when upstream vulnerabilities are discovered.

Benefits of hardened container images

There are a confluence of factors driving organizations to realize the benefits of hardened images. 

1. Software supply chain attacks and zero-trust security

Containers were not initially designed with security in mind; they were designed for convenience. They traditionally came filled with bloat -- packages, binaries and libraries that a particular application will never actually use.

"The images that Minimus, Chainguard and everybody else are providing are so stripped down, there's not much in there for attackers to use to live off the land. So, there is this real reduction in post-compromise risk and post-compromise attack surface," said Neil Carpenter, Go-to-market at Minimus, a vendor in the vulnerability-free container space.

2. Compliance

Regulatory requirements, including FedRAMP, the EU Cyber Resilience Act and DORA, have made hardened container images necessary.

"FedRAMP is probably the deepest end of the vulnerability management pool," Carpenter told TechTarget. "For FedRAMP, you have to report monthly on every vulnerability in your environment and what your plan for addressing it is. Which is insane … being able to replace every public image you're using -- [containing] hundreds of vulnerabilities -- with ones that are tightly managed is a huge advantage for those shops."

3. Removing toil for developers

It's onerous for developers to manually monitor, maintain and patch the hundreds of libraries that come packaged in container images. That's where hardened container images come in. They strip images down to limit the attack surface.

"There's a real advantage in making vulnerability management work easier," Carpenter said.

He described his previous experience at Orca, where its security product gave dev teams instant security visibility. This service often surfaced hundreds of thousands of vulnerabilities in 15 minutes. This puts development teams tasked with shifting security left and applying app sec at the build stages in sticky situations.

"Now there's a ton of friction and the first thing the developer is trying to do is figure out how to route around security because they have real goals around shipping features, fixing bugs, etc.," Carpenter said. 

Starting with a hardened image and builder ensures developers only need to worry about the vulnerabilities a developer introduced, instead of the thousands of vulnerabilities that come from off-the-shelf public images.

4. Prevention early in the development cycle

Instead of scanning for and detecting vulnerabilities downstream, hardened container images focus on preventing them from the start.

The move to prevention from detection comes as the signals that vulnerability scanners rely on are becoming less dependable.

"Going into 2026, the combination of gov't funding issues, layoffs at NIST and CISA, rising numbers of legit CVEs, and the AI-driven CVE slop means that the data we need for vulnerability management is going to get worse rather than better," wrote Carpenter in a November 2025 LinkedIn post.

NIST announced in April 2026 that it would reduce the amount of CVEs that get enriched with data that scanners rely on. This means it is no longer a dependable single source of truth, creating problems for scanners that count on it as a lone signal. Carpenter covers the changing, more decentralized landscape of NVD enrichment in a Minimus blog post from June.

Preventing risk at the beginning of development narrows the scope of vulnerabilities on scanners are responsible for later in the SDLC.

5. Performance

Hardened images also offer performance improvements. Generic container images are a lot larger than normal images, containing vestigial packages, binaries and libraries that might never be needed. More bloatware means more potential performance problems.

"So, if we compare base images, just check the size. The size may be different by multiple times -- like 100 megabytes versus 400 or 500 megabytes -- and that's the image to run the same application, which means 75% of it is bloatware," said Dmitry Chuyko, senior performance architect at BellSoft.

Ben Lutkevich is an award-winning technology writer and editor covering IT infrastructure, app development and AI.

Dig Deeper on Application Architecture