The complexity of modern containerized applications often leaves developers drowning in a sea of “noise”—vulnerabilities that exist in the file system but pose zero actual risk to the application. The integration between Black Duck and Docker Hardened Images (DHI) provides a definitive answer to this challenge. By combining Docker’s secure-by-default foundations, using VEX (Vulnerability Exploitability eXchange) statements, and Black Duck’s industry-leading analysis engines, teams can now automatically separate base-layer noise from application-layer risk.
By combining Docker’s secure-by-default foundations, using VEX (Vulnerability Exploitability eXchange) statements, and Black Duck’s industry-leading analysis engines, teams can now automatically separate base-layer noise from application-layer risk.
TL;DR: The Black Duck + Docker Value Proposition
- Zero-Config Recognition: Black Duck automatically identifies DHI base images during scanning without manual tagging.
- Precision Triage: Leverage Docker-provided VEX data and Black Duck Security Advisories (BDSAs) to ignore “not affected” base image vulnerabilities.
- Comprehensive Vulnerability Intelligence: Combine Docker’s exploitability data with Black Duck’s proprietary research to reduce triage costs and eliminate false positives.
- Compliance on Autopilot: Export high-fidelity SBOMs enriched with VEX exploitability status, supporting transparent vulnerability obligations present in global regulations like the European Cyber Resilience Act (CRA) and industry standards such as those mandated by the FDA for medical devices and governmental agencies.
A Comprehensive Strategy for Software Integrity
Black Duck’s strategy for container security is built on a “Better Together” philosophy, leveraging two distinct but complementary analysis technologies to provide 360-degree visibility:
- Black Duck Binary Analysis (BDBA): Our primary integration for DHI was released on April 14, 2026. BDBA provides deep, signature-based inspection of compiled assets within DHI, verifying the “as-shipped” state of your containers without needing access to source code.
- Black Duck Software Composition Analysis (SCA): Soon, Black Duck will extend this DHI identification and verification support to our flagship SCA platform. This upcoming release will unify DHI intelligence with source-side dependency management, providing a single, comprehensive Software Bill of Materials (SBOM) across the entire SDLC.
Deep Visibility with Binary Match & SCA Roadmap
While traditional scanners often rely on simple package manager manifests, Black Duck looks deeper.
- Signature-Based Accuracy: Using BDBA (launching March 31st), Black Duck identifies DHI components by their binary “fingerprint,” ensuring accuracy even if package metadata is stripped or modified.
- The Path to Unified SCA: Our roadmap includes bringing these DHI insights directly into Black Duck SCA. This will allow security teams to apply the same governance policies to DHI-based containers as they do to their application source code, all within a single pane of glass.
- Layer-Specific Analysis: Easily pivot between the hardened base image and your custom application layers to understand exactly where a risk was introduced.
Dynamic Risk Triage: VEX + BDSA Intelligence
The most significant drain on developer productivity is manual triage. This integration operationalizes “Reachability” and “Exploitability” through automated data streams:
- VEX Integration: Black Duck ingests Docker’s VEX statements as a primary source of truth. If Docker confirms a base image vulnerability is “not_affected” due to the hardening process, Black Duck automatically suppresses the alert.
- Beyond the NVD: While competitors rely on the National Vulnerability Database (NVD), Black Duck uses BDSAs. These advisories often arrive days before the NVD, providing deeper exploitability context and specific remediation paths.
- Bulk Policy Enforcement: Security teams can set global Black Duck policies to automatically “ignore” any vulnerability backed by a “not_affected” vulnerability status statement from Docker, potentially clearing thousands of non-actionable alerts with zero manual effort.
Operationalizing Security with Automated Workflows
Black Duck does more than find issues; it manages the lifecycle of the container:
- SLA Tracking: Automatically trigger Jira tickets or email alerts when a vulnerability in a custom layer exceeds your organization’s risk threshold.
- Pipeline Gating: Use the Black Duck Detect CLI to fail builds only when reachable or unaddressed risks are found in your application code, keeping the CI/CD pipeline moving.
- Continuous Patching: For Enterprise DHI users, Black Duck verifies when a patched base image is mirrored to your private repository, confirming mitigation without requiring a developer to manually “re-scan” to prove compliance.
Get started for free
- Check Docker Documentation on VEX at https://docs.docker.com/dhi/core-concepts/vex/
- Learn more Docker’s approach to CVE exploitability and auditability at https://www.docker.com/blog/why-we-chose-the-harder-path-docker-hardened-images-one-year-later/
- Read on Black Duck’s VEX documentation at https://documentation.blackduck.com/bundle/bd-hub/page/Reporting/vexReport_global.html
