Aikido now scans Docker Hardened Images (DHI) with built-in VEX support. Vulnerabilities that Docker has verified as non-exploitable drop out of the queue automatically, so developers spend their time on findings that actually matter. This post walks through what changed, why it matters, and how users can benefit from the new integration.<\/p>\n
Modern application teams drown in CVEs. And the volume is climbing fast. AI coding agents now generate and assemble software far faster than any team can review it, pulling in dependencies by the hundreds and spinning up new services on demand. Every base image they reach for is another stack of CVEs landing in someone\u2019s queue. The faster code ships, the more it matters that it starts from a foundation that\u2019s already minimal, already patched, and already vetted \u2014 which is exactly why hardened images matter more now than they ever have.<\/p>\n
Docker Hardened Images addresses this problem at the source. DHI images are purpose-built, often distroless, and ship with only the software the workload needs. The attack surface is smaller by construction. Patches land faster than upstream in many cases.<\/p>\n
A smaller attack surface only helps if your scanner can see it. Distroless images break tools that expect a package manager or a shell. Naive scanning produces false positives against components that are not actually present, or flags CVEs in code paths that cannot be reached. Teams end up triaging noise that the image author already knew was not a problem.<\/p>\n
The new integration closes this gap. DHI publishes signed VEX attestations alongside each image. Aikido reads those attestations and applies them during triage. The CVEs Docker has already cleared get filtered out, with a clear reason attached.<\/p>\n
You need three things to scan DHI with Aikido:<\/p>\n
In Aikido, go to Settings > Containers<\/strong> and click Connect Registry<\/strong>. Once the registry is connected, open the registry action menu and click Scan repos in registry<\/strong>. There is no extra configuration for DHI. Aikido detects hardened images automatically and applies the right data sources in the background.<\/p>\n Under the hood, the workflow follows the DHI technical spec:<\/p>\n
Select Docker Hub<\/strong>.
Enter your organization namespace, username, and Personal Access Token.
Aikido discovers your repositories and lists them for scanning.<\/p>\nScan a Docker Hardened Image<\/strong><\/h2>\n
\n
How VEX status shows up<\/strong><\/h2>\n