AI
The Software Supply Chain Trust Gap
Open source now makes up 70 to 90% of the average codebase, but only 15% of organizations feel confident managing it. That gap is widening. At the same time, AI-related image pulls on Docker Hub grew 130% in the past year as teams moved from experimentation to production deployments.
Tushar Jain framed both shifts as a single problem: supply chain risk has become a board-level conversation, and the tooling for agentic applications is still DIY. Wiring together models, MCP tools, and services requires too much boilerplate, and the security and observability of that stack is, in his words, “questionable at best.”
Docker Hardened Images: Minimal Footprint, Full Attestation
Docker Hardened Images ship with near-zero CVEs, a 95% attack surface reduction, and over a dozen attestations: SBOM, SLSA provenance, and VEX. Every image starts from scratch, includes only the software the application needs, and defaults to non-root users with no embedded secrets. Mike Donovan walked through the DHI Node migration demo (08:56) live: a standard Node image scanned by Docker Scout showed 700 packages and hundreds of CVEs.
“Vulnerabilities go down to zero, the packages required are only 12.” — Michael Donovan
Switching the FROM statement to Docker Hardened Images cleared every CVE. The multistage pattern uses a dev variant to build source code, then a runtime-only variant for production, removing NPM, Python, and other build tools. Migration is one line.
Gated Deployments: Blocking Vulnerable Images at AKS
Toddy Mladenov from Microsoft ran a Python-slim image through Trivy: 109 vulnerabilities. Deploying it to AKS failed. Defender for Containers had a gated-deployment policy set to deny any image with high or critical CVEs.
“This image contains one high or higher CVE, which is more than allowed count of zero.” — Toddy Mladenov
ACR Tasks pulled the Docker Hardened Image, verified SLSA, VEX, SBOM, and provenance attestations, then copied it into ACR only after all checks passed. The application image rebuilt on DHI showed zero Trivy findings and deployed cleanly. Mladenov noted that 90% of CVEs developers can’t fix come from the OS layer, which DHI eliminates.
MCP Catalog, Model Runner, and the Agentic Trust Layer
Docker launched two catalogs for agentic applications. The MCP Catalog covers verified tools from GitHub, Stripe, Slack, and 100-plus providers, each packaged as a container. The Model Catalog includes Phi, Llama, Gemma, and DeepSeek. Running a model locally is docker model run; connecting an MCP tool is docker mcp, using the same CLI developers already know.
Every tool runs through an MCP Gateway that handles secret scanning, audit logging, and signature verification. If a tool response contains a secret, the gateway blocks it before the agent sees it. Scope limits are one flag in the Compose file.
Docker Compose as the Agentic Orchestration File
Docker extended Compose with model and MCP providers. A single docker-compose.yml now declares the MCP Gateway, a local model, and each agent as a plain Docker image with its allowed tools, system prompt, and model. Donovan demonstrated the GitHub-to-Notion multi-agent demo (48:12): one docker compose up started a coordinator, GitHub agent, Notion agent, and a local summarizer.
One prompt sent the coordinator to fetch GitHub issues, summarize them through Docker Model Runner, and post the result to Notion. A second run showed the MCP Gateway catching a secret in a file response and blocking it before the agent could read it.
Notable Quotes
Vulnerabilities go down to zero, the packages required are only 12. Michael Donovan · ▶ 8:47
This image contains one high or higher CVE, which is more than allowed count of zero. Toddy Mladenov · ▶ 20:32
Docker Hardened Images are your new baseline, and this is available today. Tushar Jain · ▶ 29:00
Key Takeaways
- Docker Hardened Images cut image attack surface by 95% and ship with SLSA provenance, SBOM, and VEX attestations — available today.
- Microsoft Defender gated deployments can block any image with high or critical CVEs from reaching AKS, enforcing a zero-tolerance policy automatically.
- Docker Compose now supports model and MCP providers, letting a single file declare agents, tools, security rules, and local models for agentic applications.