Originally reported by SiliconAngle. Original announcement date: May 2020.
Overview
Software container company Docker Inc. announced a partnership with British cybersecurity startup Snyk Ltd. to deliver what both companies described as the first native vulnerability scanning service for container images. The integration was designed to bring continuous security directly into the Docker developer workflow, eliminating friction that had historically made securing containers a cumbersome, multi-step process.
The Problem: Vulnerability Scanning Was Never Seamless
Before this partnership, identifying and remediating vulnerabilities in container images required developers to bolt on third-party scanning tools outside of their primary workflow. This added steps, context switching, and delays — all friction points that slow down delivery pipelines and reduce the likelihood that security checks are run consistently.
The core challenge is the layered nature of container images. A typical image bundles an operating system base layer, language runtimes, and application dependencies. Vulnerabilities can exist at any of these layers, and tracking them across open-source libraries introduces significant complexity.
What the Docker–Snyk Integration Provides
- Automatic scanning of Docker Hub repositories: Container images stored in Docker Hub would be scanned by Snyk’s engine without requiring developers to configure a separate pipeline step.
- Open-source library vulnerability detection: Snyk’s scanning covers known vulnerabilities in open-source packages bundled inside images, surfacing Common Vulnerabilities and Exposures (CVEs) directly to the developer.
- Continuous security: Rather than one-time scans, the integration was intended to provide ongoing monitoring so that newly disclosed vulnerabilities in existing images are flagged proactively.
- Streamlined remediation guidance: Snyk’s tooling is known for providing actionable fix advice — such as suggesting a patched base image or a newer version of a dependency — rather than simply reporting a problem.
Strategic Context: Docker’s Refocus on Developer Experience
The partnership arrived at a pivotal moment for Docker. Following the sale of its enterprise business to Mirantis Inc. in late 2019, Docker shifted its strategic focus back to the developer experience. The company outlined plans to build a fully supported DevOps toolchain centered on developers who work with containers day to day. Integrating security natively — rather than treating it as an enterprise add-on — was a core part of that repositioning.
Justin Graham, Docker’s Vice President of Products at the time, framed the goal clearly:
“We are giving developers and development teams the peace of mind that container images stored in their Docker Hub repositories are scanned, and vulnerabilities identified and communicated to them, while eliminating extra steps in their application development workflow.”
— Justin Graham, VP of Products, Docker
Snyk’s Position in the Security Ecosystem
At the time of the announcement, Snyk had recently completed a $150 million Series D funding round in January 2020, achieving unicorn status with a valuation exceeding $1 billion. The company had built a reputation for developer-first security tooling — a philosophy closely aligned with Docker’s renewed focus on developer workflows.
Aner Mazur, Chief Product Officer at Snyk, described the broader intent of the partnership:
“This partnership is making security a top priority in the container application development process and setting a new standard for early and continuous application security driven by the development team.”
— Aner Mazur, CPO, Snyk
Why Container Image Security Matters
Containers have become the dominant packaging and deployment mechanism for modern applications. Because container images abstract away the underlying infrastructure, a single vulnerable image can propagate across many environments and cloud platforms. The shift-left security principle — catching vulnerabilities as early as possible in the development lifecycle — is especially important in containerized workflows, where images are built frequently and deployed at scale.
Holger Mueller, analyst at Constellation Research, noted at the time that making containers more productive and secure is a shared responsibility for platform companies like Docker:
“Docker’s partnership with Snyk achieves that, so it is a key contribution to make containers more robust for enterprises and help developers build containerized apps.”
— Holger Mueller, Analyst, Constellation Research
Availability
At announcement in May 2020, both companies stated that Snyk’s image scanning capability would be made available to Docker users in Q3 2020. Developers using Docker Hub were the primary target audience for the initial rollout.
Key Takeaways for DevOps Teams
- Native vulnerability scanning reduces the tooling overhead of securing container images.
- Integrating Snyk’s scanning into Docker Hub targets the point where images are stored and shared — a natural enforcement checkpoint.
- Developer-centric security tooling, which provides fix guidance alongside vulnerability reports, improves the chance that issues are actually remediated.
- Continuous scanning addresses the reality that new CVEs are disclosed after an image is built, not just at build time.
Note: This article reflects the state of the Docker–Snyk partnership as announced in May 2020. Both products have evolved since this date. Refer to the current Docker documentation and Snyk documentation for up-to-date feature availability.