Hardened images

Integrating with Docker Hardened Images

Docker Hardened Images (DHI) are minimal, secure, and production-ready container base and application images maintained by Docker. Designed to reduce vulnerabilities and simplify compliance, DHI integrate easily into your existing Docker-based workflows with little to no retooling required.

You can retrieve these images through Cloudsmith by configuring an upstream to the DHI registry.

Docker offers a free DHI Community registry (dhi.io) that contains developer images, as well as DHI Select and Enterprise tiers. With DHI Select and Enterprise, you can mirror images to a private Docker organization.

Upstream configuration

Form Field	Description
Name	A descriptive name for this upstream source. A shortened version of this name will be used for tagging cached packages retrieved from this upstream.
Priority	The weighting of the upstream source. Upstream sources are selected for resolving requests by sequential order (1..n), followed by creation date.
Proxy URL	The URL for this upstream source. This must be a fully qualified URL including any path elements required to reach the root of the repository.
Proxy Only	Proxy requests through to upstream sources in order to match assets that are not present in this repository.
Cache and Proxy	Proxy the initial request for an asset through to the upstream source and then store (cache) resolved assets in this repository for future requests.
Authentication	Select the authentication method required by this upstream. If the upstream does not require credentials, select None from the dropdown. Note If a Docker Hub or DHI upstream is created without authentication credentials, it will authenticate by using a Cloudsmith-managed Organization Access Token (OAT). This gives you a higher rate limit than fully anonymous access. Your workspace name will be shared with Docker so that they can attribute usage to the originating workspace.
Headers (optional, under Additional options)	Optional key-value headers that can be passed to upstreams with each request.
Verify SSL Certificates (under Additional options)	If enabled, SSL certificates are verified when requests are made to this upstream. We recommend leaving this enabled for all public sources to help mitigate Man-In-The-Middle (MITM) attacks.

Adding the DHI registry as an upstream

You can integrate the DHI registry into your Cloudsmith account by adding a DHI upstream.

DHI Select/Enterprise
To use the Select/Enterprise tier, you must configure the DHI registry as a private upstream with your Docker Hub credentials.

In your Cloudsmith repository, go to the Sources tab.
If you have existing upstreams configured, click + Configure new upstream.
In the modal, select the Hardened images tab, then click the Docker Hardened Images card.
Select a tier: Community or Select/Enterprise.
In the Name field, enter a descriptive name for the upstream.
In the Priority field, specify a priority for the upstream. For more information about upstream priority, see Upstream concepts: Priority.
The Proxy URL field is pre-filled with the DHI registry URL: https://dhi.io.
Under Package delivery, select Cache and proxy.
Under Authentication:
- Community: select None. Cloudsmith authenticates with a Cloudsmith-managed Organization Access Token (OAT), which gives a higher rate limit than anonymous access, and shares your workspace name with Docker so it can attribute usage.
- Select/Enterprise: select Basic Auth and enter your Docker Hub username and password.
(Optional) Click Additional options, then add key-value headers to pass to the upstream with each request.
Click + Add upstream.

Your DHI upstream appears on the Upstream registries section of the Sources tab.

Mirrored DHI Select/Enterprise images
You can pull mirrored DHI Select/Enterprise images through https://dhi.io or a standard Docker Hub integration by specifying your Docker organization in the image path (mydockerorg/dhi-node:latest).

Pull a DHI image with Docker native tooling

To pull the node Docker Hardened Image into Cloudsmith:

Configure a Cloudsmith upstream for DHI by using the steps in Adding the DHI registry as an upstream.
Verify Docker is installed and running.
Open a terminal
Log in to Docker with your Cloudsmith username and token:
bash
```
docker login docker.cloudsmith.io
```
Pull the DHI node image, replacing WORKSPACE and REPOSITORY with your Cloudsmith workspace and repository:
bash
```
docker pull docker.cloudsmith.io/WORKSPACE/REPOSITORY/node:20-alpine3.22
```
Verify that the image appears in your Cloudsmith repository.

Updated 2 days ago