CNCF Score project improved its security posture by joining the Docker-Sponsored Open Source Program

The brief

The CNCF Score project improved its security posture by joining the Docker-Sponsored Open Source Program, which provides access to Docker's security scanning tools, container registry, and best-practice resources at no cost. Through this program, Score publishes its container images on Docker Hub, increasing their visibility and giving the community a verified, trusted source. The program also provides usage analytics, showing how the community uses these images.

The DSOS Program gave Score access to Docker Scout, which is used in pull requests and on the container registry to provide clear visibility into CVEs introduced or fixed by each pull request and release. Docker Scout also provides a single view of CVEs, packages, base images, and policies across all container images, making it easy to see what is used where and in which version. Additionally, Score adopted Docker Hardened Images, which are minimal, security-focused container base images designed to reduce inherited risk in downstream projects.

Docker Hardened Images offer a minimal attack surface, non-root execution, supply chain security, active maintenance, and open standards. The Docker GitHub Builder gives Score a Docker-maintained build pipeline with signed SLSA provenance and SBOM attestations, helping consumers verify the builder identity and trace images back to their source commit. Furthermore, Docker introduced OIDC connections, allowing pulls and pushes to Docker Hub to use a short-lived token instead of a long-lived Organization Access Token.