RapidFort, a software supply chain security company based in Sunnyvale, California, has partnered with GitLab to deliver hardened container images for GitLab's regulated self-managed deployments. Teams can remove vulnerabilities without changing application code or moving to a proprietary operating system. The images keep GitLab's existing functionality and version tags. They are available now through the RapidFort Curated Catalog, a library of more than 48,000 container images. RapidFort says the images are patched daily, with fixes for critical and high severity vulnerabilities within seven calendar days of an upstream patch. They include hardened configurations and compliance reports for standards such as FedRAMP and CMMC. George Manuelian, RapidFort's chief strategy officer, said the partnership moves the industry "from detecting vulnerabilities to eliminating them at the source.

RapidFort to deliver hardened container images for GitLab regulated Self-Managed Deployments. RapidFort announced a new strategic partnership with GitLab to deliver hardened container images for GitLab regulated Self-Managed Deployments. The offering enables development and security teams to identify and eliminate vulnerabilities within the GitLab workflows they already use, without requiring changes to application code or migration to a proprietary operating system. The partnership combines GitLab's DevSecOps platform with RapidFort's industry-first combination of minimal and near-zero CVE container images, attack surface management, and continuous runtime monitoring. The images retain GitLab's existing functionality and version tags, so teams can adopt them without changing how they build and ship software. "Regulated organizations need confidence in what they deploy and flexibility to meet their security requirements," said Omer Azaria, VP of Product Management, GitLab. "Through our strategic partnership with RapidFort, regulated and air-gapped customers have a new way to get hardened, continuously patched GitLab images, along with audit-ready evidence, without slowing development." "This partnership is designed to let joint customers establish a golden image pipeline for GitLab - a single, centrally governed, hardened source of GitLab images that flows through the customer's build, security scanning, and deployment stages," said George Manuelian, Chief Strategy Officer at RapidFort. "It moves the industry from detecting vulnerabilities to eliminating them at the source, making secure-by-default software achievable at scale inside the platform where code is built. "For self-managed customers, security doesn't stop at the application layer," said Martin Brümmer, Senior Product Manager, GitLab. "As AI accelerates vulnerability discovery, customers need to apply the same security scrutiny to the container images they use to deploy GitLab. This partnership gives customers a traceable path to hardened images and supporting security evidence." Today's announcement builds on RapidFort existing public-sector work; it already publishes an optimized, hardened image for GitLab Runner Iron Bank, and compiles security benchmarks into audit-ready evidence for FedRAMP, Authorization to Operate (ATO), Cybersecurity Maturity Model Certification (CMMC), the EU's Digital Operational Resilience Act (DORA), and the Cyber Resilience Act (CRA), while still moving at commercial development speed. Under the partnership, GitLab's on-premises images are now available through the RapidFort Curated Catalog, a library of more than 48,000 base and third-party container images spanning every major Linux distribution. Curated GitLab images will retain GitLab's existing functionality, version tags, and configuration surface. Key characteristics of curated GitLab images from this partnership include: Near-zero CVE posture, updated daily. Images are continuously patched as upstream fixes land, with published SLAs of seven calendar days for Critical/High severity CVEs, 21 days for Medium severity CVEs, and 28 days for Low severity CVEs, once an upstream patch is available. FIPS 140-2/140-3 alignment. FIPS-validated OpenSSL providers (covering downstream consumers such as cURL) are built into applicable images, with images tested against a FIPS-enabled kernel helping customers meet a prerequisite for federal and defense deployments. Security Technical Implementation Guide (STIG)-hardened configurations. These reduce the manual effort security teams spend remediating baseline findings before GitLab can be authorized for use in regulated environments. Minimal attack surface. Hardened/community image variants strip out unused packages, shells, and debug utilities, reducing image size and CVE count well beyond the base curated image. Audit-ready compliance evidence. RapidFort's Compliance and Remediation Tool (CART) component continuously validates images against security baselines and generates compliance reports usable in support of FedRAMP, CMMC, CRA, SOC 2, and CIS Benchmark assessments - reducing the manual evidence-gathering burden during ATO and audit cycles. Availability Multiple GitLab images are available immediately in the RapidFort Curated Images catalog, giving joint customers a ready-to-use starting point for hardened, on-prem GitLab deployments. David Marshall is the founder of VMblog.com, one of the industry's longest-running independent publications covering modern data center technologies. What began as a focus on virtualization and cloud computing has expanded to cover the full spectrum of enterprise IT, including AI, security, and DevOps, making VMblog a trusted destination for vendor news, technology analysis, and industry commentary.Beyond publishing, David has spent his career at the intersection of technology and business, inventing, marketing, and launching a number of successful software companies and products, and building a reputation as a skilled marketing executive in the enterprise IT space.David is also a published author, having written two well-regarded books on virtualization and served as technical editor for two "For Dummies" titles covering virtualization and cloud computing. He co-founded CloudCow.com, a publication focused on cloud computing, and has been named a VMware vExpert every year since 2009, one of the longest continuous honoree streaks in the program's history.Connect with David on LinkedIn: https://www.linkedin.com/in/davidmarshall/