What are the security benefits of a hardened image?
A hardened image is a pre-configured template for containers or VMs that's been systematically stripped of vulnerabilities and unnecessary components in order to minimize your attack surface and meet compliance requirements.
Because of this hardening process, these images…
Reduce vulnerabilities
Reduce alert noise
Free developers from time-consuming patching cycles
Facilitate cleaner audits
When developers use off-the-shelf images from Docker or other open source repositories, images often ship with shells, package managers, compilers, debugging tools, and pre-installed libraries that aren’t essential at runtime. As a result of this bloat, images introduce unnecessary attack surface and vulnerabilities.
Secured Images 101
Secure your container ecosystem with this easy-to-read digital poster that breaks down everything you need to know about container image security.
Key elements of the image hardening process
There are three core pillars in the image hardening process:
Minimization: The first step is decluttering non-essential binaries, shells, and libraries. If your app doesn't need a Bash shell, it doesn't get one. If you don't need curl, apt-get, or a compiler, those go too.
Vulnerability remediation: After minimization, it’s time to scan what’s left to identify CVEs and then proceed with patching. (Because there are fewer components, there's less to patch!)
Configuration hardening: The final step is locking down the behavior by disabling unnecessary services, setting restrictive permissions, running as non-root, and declaring filesystems as read-only.
Hardening standards: Choose your blueprint
There are a number of industry frameworks designed to provide you with a proven roadmap for hardening. Choosing the right one depends on your compliance requirements and operational needs. When evaluating hardening standards, CIS Benchmarks are often the go-to starting point.
CIS Benchmarks
The Center for Internet Security publishes hardening guidelines known as the CIS Benchmarks, and these work for most enterprises.
CIS Benchmarks offer tiered guidance: Level 1 is for foundational, essential controls. Level 2 is for advanced hardening. It might break certain features or limit everyday functionality, but it offers maximum security, covering everything from OS configurations to network access controls.
Who it's best for: Hardening standards like CIS are great for enterprises trying to balance operational flexibility, security, and compliance with regulatory frameworks like PCI DSS, HIPAA, and FedRAMP.
DISA STIGs
The Defense Information Systems Agency (DISA) offers Security Technical Implementation Guides (STIGs) that are far more prescriptive than the CIS Benchmarks. DISA STIGs include extremely detailed security controls that cover everything from kernel parameters to audit logging.
Who it's best for: Compliance is required for the U.S. Department of Defense, federal agencies, and their contractors. If you're touching classified data or working within the federal supply chain, STIGs aren't optional.
Custom hardening baselines
Unlike standard images that often ship with large development frameworks and unnecessary debugging tools, custom hardening baselines give you the flexibility to combine elements from multiple standards with internal requirements. Many enterprises start with CIS images as the foundation, add STIG controls for regulated workloads, then customize for business-specific needs.
Container Images Demystified: Structure, Security, and Best Practices
Learn how container images work, their role in deployment, security risks, and best practices to streamline and protect your cloud-native applications.
En savoir plus
Types of hardened images
There are different types of hardened images, depending on what you're protecting: hardened VM images and hardened container images.
Hardened VM images
VM hardening secures a general-purpose OS designed to run persistent, scalable services and manage multiple users. In cloud environments, these are often baked into golden images (for example, AMIs in AWS) via pipelines.
Since VMs typically require a complete OS kernel, init system (systemd), and management tools (SSH, logging agents), hardening focuses on locking down these components rather than removing them entirely.
Key hardening actions
Disabling unused ports (Telnet, Finger, other unused services)
Removing default accounts and guest users
Kernel tuning to prevent memory exploits and kernel-level attacks
Enforcing strict file permissions and SELinux policies
Hardened VM images almost always map to CIS Benchmarks or STIGs because auditors and regulators already know and trust them.
Hardened container images
While containers are designed to provide operational boundaries, their effectiveness relies on the code and libraries packaged within the image.
Because containers share the host kernel and ideally run a single process, the goal of container hardening is minimization and immutability of the application environment. The gold standard here is to reduce CVEs to zero and remove any packages, utilities, or other dependencies that aren’t essential at runtime.
Key hardening actions
Setting a non-root user so container processes can't escalate to root
Removing package managers after the build phase (an attacker can't execute apt-get if apt doesn't exist)
Declaring the filesystem as read-only
Removing shells and debugging tools
Disabling unnecessary network services
This approach works because containers don't need the full OS but only a runtime environment. By treating containers as single-purpose appliances rather than mini Linux distros, hardening becomes clear and surgical.
Watch 12-min demo
See Wiz identifies exposed containers, visualizes the full attack path, and fixes the issue directly in code.
How to overcome hardened image implementation challenges
Challenge #1: Loss of debugging tools and visibility
The most common complaint from developers is, "Where is my shell?" Debugging complexity spikes when you can't shell into a container and run ps, netstat, or curl because those OS utilities were stripped out during minimization.
Solution: Provide workarounds. Instead of making troubleshooting impossible, give developers alternatives like ephemeral debug containers so they can investigate issues without weakening the production image.
Challenge #2: Application compatibility roadblocks
Teams often face compatibility issues when an older library their application strictly relies on is taken out during the minimization process.
Solution: Validate the hardening approach with early adopters, and stage your rollouts before mandating minimized images across the entire organization.
Challenge #3: The perpetual maintenance
Vulnerabilities are discovered daily. If you maintain your own cyber hardened base images, you are signing up for a relentless, perpetual cycle of patching and rebuilding.
Solution: Commit to monthly security updates, or better yet, offload this work by selecting base images that are continuously patched by a vendor under an SLA.
Challenge #4: Internal friction and migration effort
Migration takes effort, and often faces internal resistance. Teams need to understand that migrating to hardened images can drastically lower total cost of ownership through fewer vulnerability alerts and automated compliance evidence collection.
Solution: Leverage a solution that provides visibility across your existing container estate, identifies and tracks migration opportunities, and leverages AI to assist in migration. At the same time, use policy tools in your pipeline to automatically block old, vulnerable image versions from reaching production.
What is container image scanning?
Container image scanning is the automated process of analyzing container images for security vulnerabilities, misconfigurations, and compliance violations.
En savoir plusHow Wiz helps organizations start securely with hardened images
Wiz has you covered by providing hardened images as part of a platform that gives you visibility and security controls across your entire container estate. With Wiz, you can easily adopt and migrate to hardened images with AI-powered migration.
Here’s how Wiz helps you adopt hardened images:
WizOS images: Designed to let developers hit the ground running, WizOS is Wiz's catalog of hardened, minimal container base images maintained at near-zero CVEs. (Wiz meets strict SLAs for CVE remediation: 7 days for critical severity and 14 days for high and medium.) Every image is built from source and includesSBOMs and verifiable provenance.
Complete visibility: Wiz aggregates scanning insights into a centralized container image inventory, providing a clear snapshot of every container image and its current security posture across your environment. You can see where you’re already running hardened images, and what images should be migrated.
Secure architecture opportunities: Wiz identifies opportunities for migration to hardened images, grouping existing images by type. For each group you can see associated vulnerabilities, related security issues, and estimated effort to complete the swap, giving teams a risk-ordered starting point.
Automated policy enforcement: Wiz’s integration capabilities extend into the CI/CD pipeline for automated policy enforcement. It can block problematic builds that use non-compliant base images or fail to meet vulnerability thresholds. You define the policies, and the platform enforces them.
WizOS provides teams with hardened, near-zero CVE base images to eliminate manual maintenance, and the broader Wiz platform secures those workloads across their entire lifecycle. Ready to see how Wiz can modernize your base images? Schedule a personalized demo today.
Get a container security demo
Get a hands-on look at how Wiz scans your containers for vulnerabilities, and how WizOS base images can cut your CVE count down to near zero.
