{"id":5325,"date":"2026-11-05T14:18:50","date_gmt":"2026-11-05T14:18:50","guid":{"rendered":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/2026\/11\/05\/cncf-score-project-improved-its-security-posture-by-joining-the-docker-sponsored-open-source-program\/"},"modified":"2026-11-05T14:18:50","modified_gmt":"2026-11-05T14:18:50","slug":"cncf-score-project-improved-its-security-posture-by-joining-the-docker-sponsored-open-source-program","status":"publish","type":"post","link":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/2026\/11\/05\/cncf-score-project-improved-its-security-posture-by-joining-the-docker-sponsored-open-source-program\/","title":{"rendered":"CNCF Score project improved its security posture by joining the Docker-Sponsored Open Source Program"},"content":{"rendered":"<p class=\"wp-block-paragraph\">Score, a CNCF Sandbox project, recently joined the <a href=\"https:\/\/docs.docker.com\/docker-hub\/repos\/manage\/trusted-content\/dsos-program\/\" rel=\"nofollow noopener\" target=\"_blank\">Docker-Sponsored Open Source (DSOS) Program<\/a> to strengthen the security of its container images and release pipeline. In this post, the Score maintainers share what we adopted (Docker Hub, Docker Scout, Docker Hardened Images, the Docker GitHub Builder, and OIDC connections), the results we measured, and how other open source projects, within the CNCF and beyond, can apply the same practices by default.<\/p>\n<h2 class=\"wp-block-heading\">The Opportunity<\/h2>\n<p class=\"wp-block-paragraph\">In September 2025, <a href=\"https:\/\/www.cncf.io\/announcements\/2025\/09\/18\/cncf-expands-infrastructure-support-for-project-maintainers-through-partnership-with-docker\/\" rel=\"nofollow noopener\" target=\"_blank\">the CNCF announced a partnership with Docker<\/a> to expand infrastructure support for project maintainers through the Docker-Sponsored Open Source (DSOS) Program. The partnership gives CNCF projects access to Docker\u2019s security scanning tools, container registry, and best-practice resources at no cost.<\/p>\n<p class=\"wp-block-paragraph\">This aligned closely with the discussions held at the <a href=\"https:\/\/contribute.cncf.io\/blog\/2025\/11\/08\/maintainer-summit-update-from-the-project-staff\" rel=\"nofollow noopener\" target=\"_blank\">Maintainer Summit NA 2025 in Atlanta<\/a>, which centered on increasing collaboration across CNCF projects and demonstrating security best practices.<\/p>\n<p class=\"wp-block-paragraph\">The <a href=\"https:\/\/docs.docker.com\/docker-hub\/repos\/manage\/trusted-content\/dsos-program\/\" rel=\"nofollow noopener\" target=\"_blank\">Docker-Sponsored Open Source (DSOS) Program<\/a> supports non-commercial open source projects with Docker tooling and infrastructure.<\/p>\n<p class=\"wp-block-paragraph\">Eligible projects receive:<\/p>\n<ul class=\"wp-block-list\">\n<li>Verified Docker-Sponsored Open Source badge<\/li>\n<li>Removal of rate limits for developers<\/li>\n<li>Access to Docker Scout for software supply chain management<\/li>\n<li>Insights and analytics<\/li>\n<li>Repository logo<\/li>\n<li>Improved discoverability on Docker Hub<\/li>\n<\/ul>\n<h2 class=\"wp-block-heading\">Docker Hub<\/h2>\n<p class=\"wp-block-paragraph\"><strong>Before:<\/strong> Score publishes different container images: the CLIs of <a href=\"https:\/\/github.com\/score-spec\/score-compose\" rel=\"nofollow noopener\" target=\"_blank\"><code>score-compose<\/code><\/a>, <a href=\"https:\/\/github.com\/score-spec\/score-k8s\" rel=\"nofollow noopener\" target=\"_blank\"><code>score-k8s<\/code><\/a>, <a href=\"https:\/\/github.com\/score-spec\/score-helm\" rel=\"nofollow noopener\" target=\"_blank\"><code>score-helm<\/code><\/a> and <a href=\"https:\/\/github.com\/score-spec\/score-radius\" rel=\"nofollow noopener\" target=\"_blank\"><code>score-radius<\/code><\/a>; and the <a href=\"https:\/\/github.com\/score-spec\/sample-score-app\" rel=\"nofollow noopener\" target=\"_blank\"><code>sample-score-app<\/code><\/a> used for demos and testing. We previously published them in the GitHub Container Registry <a href=\"https:\/\/github.com\/orgs\/score-spec\/packages\" rel=\"nofollow noopener\" target=\"_blank\">here<\/a>.<\/p>\n<p class=\"wp-block-paragraph\"><strong>After:<\/strong> Through the DSOS Program, we now publish these images on Docker Hub, which increases their visibility and gives the community a verified, trusted source.<\/p>\n<p class=\"wp-block-paragraph\">All the container images are now available <a href=\"https:\/\/hub.docker.com\/u\/scorespec\" rel=\"nofollow noopener\" target=\"_blank\">on Docker Hub<\/a>.<\/p>\n<div class=\"wp-block-ponyo-image\">\n                <img data-opt-id=1520889981  fetchpriority=\"high\" decoding=\"async\" width=\"1999\" height=\"999\" src=\"https:\/\/www.docker.com\/app\/uploads\/2026\/10\/image3-3.png\" class=\"fade-in\" alt=\"image3 3\" title=\"- image3 3\" \/>\n        <\/div>\n<p class=\"wp-block-paragraph\">\n<\/p><p class=\"wp-block-paragraph\">The program also provides usage analytics that show how the community uses these images. Here is an example:<\/p>\n<div class=\"wp-block-ponyo-image\">\n                <img data-opt-id=1084626220  fetchpriority=\"high\" decoding=\"async\" width=\"1999\" height=\"1341\" src=\"https:\/\/www.docker.com\/app\/uploads\/2026\/10\/image2-3.png\" class=\"fade-in\" alt=\"image2 3\" title=\"- image2 3\" \/>\n        <\/div>\n<p class=\"wp-block-paragraph\">\n<h2 class=\"wp-block-heading\">Docker Scout<\/h2>\n<\/p><p class=\"wp-block-paragraph\"><strong>Before:<\/strong> As a CNCF project, Score follows the <a href=\"https:\/\/www.bestpractices.dev\/en\" rel=\"nofollow noopener\" target=\"_blank\">OpenSSF best practices<\/a>. In addition, the <a href=\"https:\/\/securityscorecards.dev\/\" rel=\"nofollow noopener\" target=\"_blank\">OpenSSF Scorecard GitHub Action<\/a> runs continuously. This was a solid foundation, but we had no dedicated security scanning tool in place.<\/p>\n<p class=\"wp-block-paragraph\"><strong>After:<\/strong> The DSOS Program gave us access to Docker Scout, which we now use in our pull requests and on our container registry (Docker Hub). This gives us clear visibility into the CVEs introduced or fixed by each pull request and release.<\/p>\n<p class=\"wp-block-paragraph\">The following GitHub Actions step uses <code>docker\/scout-action<\/code> on every pull request to compare the image built from the PR branch with the one built from the main branch:<\/p>\n<div class=\"wp-block-syntaxhighlighter-code \">\n<pre class=\"brush: plain; gutter: false; title: ; notranslate\">\n- name: Docker Scout Comparison between main branch and current PR branch\n  uses: docker\/scout-action@v1\n  with:\n    command: compare\n    image: local:\/\/score-compose:pr-${{ github.event.number }}\n    to: local:\/\/score-compose:main\n    write-comment: true\n    github-token: ${{ secrets.GITHUB_TOKEN }}\n    organization: ${{ secrets.DOCKER_HUB_ORG }}\n\n\n<\/pre>\n<\/div>\n<p class=\"wp-block-paragraph\">Here is an example of a comment posted by this <code>docker\/scout-action<\/code> step in a recent Pull Request:<\/p>\n<div class=\"wp-block-ponyo-image\">\n                <img data-opt-id=280200297  data-opt-src=\"https:\/\/www.docker.com\/app\/uploads\/2026\/10\/image4.png\"  decoding=\"async\" width=\"1118\" height=\"1940\" src=\"data:image/svg+xml,%3Csvg%20viewBox%3D%220%200%20100%%20100%%22%20width%3D%22100%%22%20height%3D%22100%%22%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%3E%3Crect%20width%3D%22100%%22%20height%3D%22100%%22%20fill%3D%22transparent%22%2F%3E%3C%2Fsvg%3E\" class=\"fade-in\" alt=\"image4\" title=\"- image4\" \/>\n        <\/div>\n<p class=\"wp-block-paragraph\">\n<\/p><p class=\"wp-block-paragraph\">The comment details the comparison between the two images (before versus after): size, packages updated, added or removed, CVEs introduced and resolved, and compliance with our <a href=\"https:\/\/docs.docker.com\/scout\/policy\/\" rel=\"nofollow noopener\" target=\"_blank\">policies in place<\/a> (run as non-root, no critical CVEs, no packages with AGPL v3 licences).<\/p>\n<p class=\"wp-block-paragraph\">The analysis goes beyond the images themselves: it also covers the Go libraries and binaries they contain.<\/p>\n<p class=\"wp-block-paragraph\">The Docker Scout console also provides a single view of CVEs, packages, base images, and policies across all of our container images, which makes it easy to see what is used where, and in which version.<\/p>\n<div class=\"wp-block-ponyo-image\">\n                <img data-opt-id=459102706  data-opt-src=\"https:\/\/www.docker.com\/app\/uploads\/2026\/10\/image8.png\"  decoding=\"async\" width=\"1999\" height=\"1029\" src=\"data:image/svg+xml,%3Csvg%20viewBox%3D%220%200%20100%%20100%%22%20width%3D%22100%%22%20height%3D%22100%%22%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%3E%3Crect%20width%3D%22100%%22%20height%3D%22100%%22%20fill%3D%22transparent%22%2F%3E%3C%2Fsvg%3E\" class=\"fade-in\" alt=\"image8\" title=\"- image8\" \/>\n        <\/div>\n<p class=\"wp-block-paragraph\">\n<h2 class=\"wp-block-heading\">Docker Hardened Images<\/h2>\n<\/p><p class=\"wp-block-paragraph\">When <a href=\"https:\/\/www.docker.com\/press-release\/docker-makes-hardened-images-free-open-and-transparent-for-everyone\/\">Docker made Hardened Images freely available under Apache 2.0<\/a>, we saw an opportunity to simplify our security posture while staying compatible with our existing Dockerfiles and workflows, even though we were already using multi-stage builds and distroless base images.<\/p>\n<p class=\"wp-block-paragraph\">Docker Hardened Images are minimal, security-focused container base images designed to reduce inherited risk in downstream projects. They are built and maintained with security and transparency as defaults, and offer:<\/p>\n<ul class=\"wp-block-list\">\n<li>Minimal attack surface: Only required components are included.<\/li>\n<li>Non-root execution: Images run as non-root by default.<\/li>\n<li>Supply chain security: Includes published SBOMs and SLSA Level 3 build provenance.<\/li>\n<li>Active maintenance: Images are patched and rebuilt as vulnerabilities are disclosed.<\/li>\n<li>Open standards: All images are reproducible, open source, and licensed under Apache 2.0, making them compatible with CNCF governance and distribution models.<\/li>\n<\/ul>\n<p class=\"wp-block-paragraph\">The migration was straightforward.<\/p>\n<p class=\"wp-block-paragraph\">Take the score-radius CLI, which used a golang:alpine and a distroless images and now uses <a href=\"https:\/\/dhi.io\/catalog\/golang\" rel=\"nofollow noopener\" target=\"_blank\">dhi.io\/golang<\/a> and <a href=\"https:\/\/dhi.io\/catalog\/static\" rel=\"nofollow noopener\" target=\"_blank\">dhi.io\/static<\/a> images. The changes required in the Dockerfile were minimal:<\/p>\n<div class=\"wp-block-ponyo-image\">\n                <img data-opt-id=1972238664  data-opt-src=\"https:\/\/www.docker.com\/app\/uploads\/2026\/10\/image5.png\"  decoding=\"async\" width=\"1999\" height=\"1184\" src=\"data:image/svg+xml,%3Csvg%20viewBox%3D%220%200%20100%%20100%%22%20width%3D%22100%%22%20height%3D%22100%%22%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%3E%3Crect%20width%3D%22100%%22%20height%3D%22100%%22%20fill%3D%22transparent%22%2F%3E%3C%2Fsvg%3E\" class=\"fade-in\" alt=\"image5\" title=\"- image5\" \/>\n        <\/div>\n<p class=\"wp-block-paragraph\">\n<\/p><p class=\"wp-block-paragraph\">In the associated PR <a href=\"https:\/\/github.com\/score-spec\/sample-score-app\/pull\/58\" rel=\"nofollow noopener\" target=\"_blank\">here<\/a>, image size dropped by 0.3 MB while the number of packages stayed the same and the CVE count remained at 0. We could have stayed with Debian, but chose to move to an Alpine base image (DHI provides the <a href=\"https:\/\/docs.docker.com\/dhi\/core-concepts\/glibc-musl\/\" rel=\"nofollow noopener\" target=\"_blank\">two options<\/a>):<\/p>\n<div class=\"wp-block-ponyo-image\">\n                <img data-opt-id=1715263747  data-opt-src=\"https:\/\/www.docker.com\/app\/uploads\/2026\/10\/image7.png\"  decoding=\"async\" width=\"1338\" height=\"1222\" src=\"data:image/svg+xml,%3Csvg%20viewBox%3D%220%200%20100%%20100%%22%20width%3D%22100%%22%20height%3D%22100%%22%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%3E%3Crect%20width%3D%22100%%22%20height%3D%22100%%22%20fill%3D%22transparent%22%2F%3E%3C%2Fsvg%3E\" class=\"fade-in\" alt=\"image7\" title=\"- image7\" \/>\n        <\/div>\n<p class=\"wp-block-paragraph\">\n<\/p><p class=\"wp-block-paragraph\">The same applies to the NodeJS sample-score-app, which used nodejs on top of an alpine image and now uses a <a href=\"https:\/\/dhi.io\/catalog\/node\" rel=\"nofollow noopener\" target=\"_blank\">dhi.io\/node<\/a> image. The changes required in the Dockerfile were minimal:<\/p>\n<div class=\"wp-block-ponyo-image\">\n                <img data-opt-id=1119969714  data-opt-src=\"https:\/\/www.docker.com\/app\/uploads\/2026\/10\/image6.png\"  decoding=\"async\" width=\"1999\" height=\"636\" src=\"data:image/svg+xml,%3Csvg%20viewBox%3D%220%200%20100%%20100%%22%20width%3D%22100%%22%20height%3D%22100%%22%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%3E%3Crect%20width%3D%22100%%22%20height%3D%22100%%22%20fill%3D%22transparent%22%2F%3E%3C%2Fsvg%3E\" class=\"fade-in\" alt=\"image6\" title=\"- image6\" \/>\n        <\/div>\n<p class=\"wp-block-paragraph\">\n<\/p><p class=\"wp-block-paragraph\">In the associated PR <a href=\"https:\/\/github.com\/score-spec\/score-radius\/pull\/28\" rel=\"nofollow noopener\" target=\"_blank\">here<\/a>, 22 packages were removed (including the package manager and the shell), along with 2 CVEs:<\/p>\n<div class=\"wp-block-ponyo-image\">\n                <img data-opt-id=797550772  data-opt-src=\"https:\/\/www.docker.com\/app\/uploads\/2026\/10\/image1-4.png\"  decoding=\"async\" width=\"1340\" height=\"1232\" src=\"data:image/svg+xml,%3Csvg%20viewBox%3D%220%200%20100%%20100%%22%20width%3D%22100%%22%20height%3D%22100%%22%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%3E%3Crect%20width%3D%22100%%22%20height%3D%22100%%22%20fill%3D%22transparent%22%2F%3E%3C%2Fsvg%3E\" class=\"fade-in\" alt=\"image1 4\" title=\"- image1 4\" \/>\n        <\/div>\n<p class=\"wp-block-paragraph\"><em>Note: We were able to present a short walkthrough of our DHI integration during the CNCF webinar held on January 23, 2026, which accompanied<\/em> <a href=\"https:\/\/contribute.cncf.io\/blog\/2026\/01\/21\/docker-hardened-images-for-cncf-projects\" rel=\"nofollow noopener\" target=\"_blank\"><em>the Docker Hardened Images announcement for CNCF projects<\/em><\/a><em>.<\/em><\/p>\n<h2 class=\"wp-block-heading\">Docker GitHub Builder<\/h2>\n<p class=\"wp-block-paragraph\">Although not directly part of the DSOS Program, we took the opportunity to adopt the new <a href=\"https:\/\/docs.docker.com\/build\/ci\/github-actions\/github-builder\/architecture\/\" rel=\"nofollow noopener\" target=\"_blank\"><code>docker\/github-builder<\/code> GitHub reusable workflow<\/a> to release our container images.<\/p>\n<p class=\"wp-block-paragraph\">This model provides a build pipeline maintained in the Docker organization, with a version-controlled BuildKit environment, multi-platform builds distributed across runners where beneficial, and signed SLSA provenance recording both the source commit and the builder identity.<\/p>\n<p class=\"wp-block-paragraph\">The trade-off is intentional. You retain control over when the build runs and which inputs it uses, while the build implementation itself lives in the Docker-maintained workflow rather than in per-repository job steps.<\/p>\n<p class=\"wp-block-paragraph\"><strong>Before<\/strong>, the GitHub Actions workflow to release our container images was using this sequence of actions:<\/p>\n<ul class=\"wp-block-list\">\n<li><code>docker\/setup-buildx-action<\/code><\/li>\n<li><code>docker\/login-action<\/code><\/li>\n<li><code>docker\/build-push-action<\/code><\/li>\n<li><code>cosign sign<\/code><\/li>\n<\/ul>\n<div class=\"wp-block-syntaxhighlighter-code \">\n<pre class=\"brush: plain; gutter: false; title: ; notranslate\">\nrelease-container-image:\n  runs-on: ubuntu-latest\n  permissions:\n    id-token: write\n    packages: write\n  steps:\n    - name: Set up Docker Buildx\n      uses: docker\/setup-buildx-action@v3\n    - name: Login to Docker Hub (docker.io)\n      uses: docker\/login-action@v4\n      with:\n        registry: docker.io\n        username: ${{ vars.DOCKER_HUB_ORG }}\n        password: ${{ secrets.DOCKER_HUB_RELEASE_TOKEN }}\n    - name: Login to GitHub Container Registry\n      uses: docker\/login-action@v4\n      with:\n        registry: ghcr.io\n        username: ${{ github.actor }}\n        password: ${{ secrets.GITHUB_TOKEN }}\n    - name: Build and push docker image\n      id: build-push-container\n      uses: docker\/build-push-action@v6\n      with:\n        context: .\n        platforms: linux\/amd64,linux\/arm64\n        push: true\n        provenance: mode=max\n        sbom: true\n        tags: |\n          ghcr.io\/score-spec\/score-compose:${{ github.ref_name }}\n          ghcr.io\/score-spec\/score-compose:latest\n          docker.io\/scorespec\/score-compose:${{ github.ref_name }}\n          docker.io\/scorespec\/score-compose:latest\n        build-args: |\n          \"VERSION=${{ github.ref_name }}\"\n    - name: Sign container image\n      run: |\n        cosign sign --yes ghcr.io\/score-spec\/score-compose@${{ steps.build-push-container.outputs.digest }}\n        cosign sign --yes scorespec\/score-compose@${{ steps.build-push-container.outputs.digest }}\n\n<\/pre>\n<\/div>\n<p class=\"wp-block-paragraph\"><strong>After<\/strong>, this same workflow is now only using the reusable workflow <code>docker\/github-builder\/.github\/workflows\/build.yml<\/code>:<\/p>\n<div class=\"wp-block-syntaxhighlighter-code \">\n<pre class=\"brush: plain; gutter: false; title: ; notranslate\">\nrelease-container-image:\n  uses: docker\/github-builder\/.github\/workflows\/build.yml@v1\n  permissions:\n    contents: read\n    id-token: write\n    packages: write\n  with:\n    output: image\n    push: true\n    platforms: linux\/amd64,linux\/arm64\n    sbom: true\n    cache: true\n    context: .\n    set-meta-labels: true\n    set-meta-annotations: true\n    build-args: |\n      \"VERSION=${{ github.ref_name }}\"\n    meta-images: |\n      ghcr.io\/score-spec\/score-compose\n      scorespec\/score-compose\n    meta-tags: |\n      type=ref,event=tag\n      latest\n    registry-identities: |\n      - type: dockerhub\n        registry: docker.io\n        username: ${{ vars.DOCKER_HUB_ORG }}\n        connection_id: ${{ vars.DOCKER_HUB_OIDC_CONNECTION_ID }}\n  secrets:\n    registry-auths: |\n      - registry: ghcr.io\n        username: ${{ github.actor }}\n        password: ${{ secrets.GITHUB_TOKEN }}\n\n<\/pre>\n<\/div>\n<p class=\"wp-block-paragraph\">Docker GitHub Builder gives us a Docker-maintained build pipeline with signed SLSA provenance and SBOM attestations, helping consumers verify the builder identity and trace images back to their source commit. Signing uses GitHub OIDC, so we don\u2019t need to manage long-lived signing keys. With caching enabled in our workflow, cache entries are also signed and verified before reuse, helping protect against cache poisoning. See the <a href=\"https:\/\/docs.docker.com\/build\/ci\/github-actions\/github-builder\/\" rel=\"nofollow noopener\" target=\"_blank\">Docker GitHub Builder documentation<\/a> for more information about its security model.<\/p>\n<p class=\"wp-block-paragraph\">The following command verifies the signature on the attestation manifest for the selected image platform:<\/p>\n<div class=\"wp-block-syntaxhighlighter-code \">\n<pre class=\"brush: bash; gutter: false; title: ; notranslate\">\nTAG=latest\nPLATFORM=amd64\n\nSIGNED_DIGEST=$(crane manifest scorespec\/score-compose:$TAG \n    | jq -r --arg platformdigest \n    \"$(crane digest --platform linux\/$PLATFORM scorespec\/score-compose:$TAG)\" \n    '.manifests[] | select(.annotations[\"vnd.docker.reference.digest\"] == $platformdigest) | .digest')\n\ncosign verify \n    --experimental-oci11 \n    --new-bundle-format \n    --certificate-oidc-issuer https:\/\/token.actions.githubusercontent.com \n    --certificate-identity-regexp  '^https:\/\/github.com\/docker\/github-builder\/.github\/workflows\/build.yml@.*$' \n    scorespec\/score-compose@$SIGNED_DIGEST\n\n<\/pre>\n<\/div>\n<h2 class=\"wp-block-heading\">OIDC Connections<\/h2>\n<p class=\"wp-block-paragraph\">Most recently, with an update released on July 21, 2026, Docker introduced <a href=\"https:\/\/docs.docker.com\/security\/authentication\/oidc-connections\/\" rel=\"nofollow noopener\" target=\"_blank\">OIDC connections<\/a>. This feature allows pulls and pushes to Docker Hub to use a short-lived token instead of a long-lived Organization Access Token (OAT).<\/p>\n<p class=\"wp-block-paragraph\">An OIDC connection establishes a trust relationship between Docker and a trusted third party, so you no longer need to maintain long-lived credentials. Docker exchanges short-lived tokens with the other vendor, which can grant fine-grained access to your Docker resources.<\/p>\n<p class=\"wp-block-paragraph\"><strong>Before:<\/strong><\/p>\n<p class=\"wp-block-paragraph\">With <code>docker\/login-action<\/code>:<\/p>\n<div class=\"wp-block-syntaxhighlighter-code \">\n<pre class=\"brush: plain; gutter: false; title: ; notranslate\">\nsteps:\n  - uses: docker\/login-action@v4\n    with:\n      username: ${{ vars.DOCKER_HUB_ORG }}\n      password: ${{ secrets.DOCKER_HUB_TOKEN }}\n\n<\/pre>\n<\/div>\n<p class=\"wp-block-paragraph\">Or with <code>docker\/github-builder<\/code>:<\/p>\n<div class=\"wp-block-syntaxhighlighter-code \">\n<pre class=\"brush: plain; gutter: false; title: ; notranslate\">\nuses: docker\/github-builder\/.github\/workflows\/build.yml@v1\nwith:\n  ...\nsecrets:\n  registry-auths: |\n    - username: ${{ vars.DOCKER_HUB_ORG }}\n      password: ${{ secrets.DOCKER_HUB_TOKEN }}\n\n<\/pre>\n<\/div>\n<p class=\"wp-block-paragraph\"><strong>After:<\/strong><\/p>\n<p class=\"wp-block-paragraph\">With <code>docker\/login-action<\/code>:<\/p>\n<div class=\"wp-block-syntaxhighlighter-code \">\n<pre class=\"brush: plain; gutter: false; title: ; notranslate\">\npermissions:\n  id-token: write\nsteps:\n  - uses: docker\/login-action@v4 # v4.5.0+\n    env:\n      DOCKERHUB_OIDC_CONNECTIONID: ${{ vars.DOCKER_HUB_OIDC_CONNECTION_ID }}\n    with:\n      username: ${{ vars.DOCKER_HUB_ORG }}\n\n<\/pre>\n<\/div>\n<p class=\"wp-block-paragraph\">Or with <code>docker\/github-builder<\/code>:<\/p>\n<div class=\"wp-block-syntaxhighlighter-code \">\n<pre class=\"brush: plain; gutter: false; title: ; notranslate\">\nuses: docker\/github-builder\/.github\/workflows\/build.yml@v1 # v1.15.0+\npermissions:\n  id-token: write\nwith:\n  ...\n  registry-identities: |\n    - type: dockerhub\n      registry: docker.io\n      username: ${{ vars.DOCKER_HUB_ORG }}\n      connection_id: ${{ vars.DOCKER_HUB_OIDC_CONNECTION_ID }}\n\n<\/pre>\n<\/div>\n<p class=\"wp-block-paragraph\">By replacing a static, long-lived token with a short-lived one\u00a0and making it issued on a per-workflow basis, we removed a credential that could otherwise be stolen and misused.<\/p>\n<h2 class=\"wp-block-heading\">Wrapping Up<\/h2>\n<p class=\"wp-block-paragraph\">Participating in the Docker-Sponsored Open Source (DSOS) Program has been rewarding, and it has helped Score adopt a security-by-default foundation. Using <a href=\"https:\/\/docs.docker.com\/scout\/\" rel=\"nofollow noopener\" target=\"_blank\">Docker Scout<\/a>, <a href=\"https:\/\/docs.docker.com\/dhi\/\" rel=\"nofollow noopener\" target=\"_blank\">Docker Hardened Images<\/a>, <a href=\"https:\/\/docs.docker.com\/enterprise\/security\/oidc-connections\/\" rel=\"nofollow noopener\" target=\"_blank\">OIDC connections<\/a>, and the <a href=\"https:\/\/docs.docker.com\/build\/ci\/github-actions\/github-builder\/\" rel=\"nofollow noopener\" target=\"_blank\">Docker GitHub Builder<\/a> has strengthened the security posture of our container images and brought broader benefits to the Score projects and repositories.<\/p>\n<p class=\"wp-block-paragraph\">If you maintain a CNCF project or any open source project, we encourage you to explore the <a href=\"https:\/\/www.docker.com\/community\/open-source\/application\/\">Docker-Sponsored Open Source (DSOS) Program<\/a>. The security improvements were measurable, and the onboarding process was straightforward.<\/p>\n<p class=\"wp-block-paragraph\">The full implementation across the Score repositories is tracked in <a href=\"https:\/\/github.com\/score-spec\/score-compose\/issues\/376\" rel=\"nofollow noopener\" target=\"_blank\">GitHub issue #376<\/a>.<\/p>\n<p class=\"wp-block-paragraph\">Attending KubeCon NA 2026 in Salt Lake City? Feel free to connect with the Score maintainers during the Maintainer Summit on Sunday, Nov 8th and at the Kiosk #P-17B on Thursday, Nov 12th between 10:15am and 2pm, you will see <a href=\"https:\/\/score.dev\/blog\/score-labspace\/\" rel=\"nofollow noopener\" target=\"_blank\">Score in actions with the new Score Labspace<\/a>!<\/p>\n<p class=\"wp-block-paragraph\"><em>Note: This work was completed after I joined Docker. It was, however, an initiative we wanted to pursue as CNCF project maintainers from the moment it was<\/em> <a href=\"https:\/\/www.cncf.io\/announcements\/2025\/09\/18\/cncf-expands-infrastructure-support-for-project-maintainers-through-partnership-with-docker\/\" rel=\"nofollow noopener\" target=\"_blank\"><em><\/em><em>announced in September 2025<\/em><\/a><em>, both to improve our security posture and to share what we learned with the broader community.<\/em><\/p>\n<p class=\"wp-block-paragraph\">We hope this post helps you strengthen the security of your own projects.<\/p>","protected":false},"excerpt":{"rendered":"<p>Score, a CNCF Sandbox project, recently joined the Docker-Sponsored Open Source (DSOS) Program to strengthen the security of its container [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":5326,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[4],"tags":[],"class_list":["post-5325","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-docker"],"_links":{"self":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts\/5325","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/comments?post=5325"}],"version-history":[{"count":0,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts\/5325\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/media\/5326"}],"wp:attachment":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/media?parent=5325"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/categories?post=5325"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/tags?post=5325"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}