Docker Hub trust badges describe who publishes an image, not how clean it is. Official images are a curated set maintained through a reviewed process, Verified Publisher images come from verified commercial publishers, and Sponsored Open Source images come from verified open source projects. Pick by the kind of software you need, then scan.
The groups side by side
| Group | Who publishes | What the badge signals | What it leaves out |
|---|---|---|---|
| Docker Official Images | A curated set maintained through a reviewed process | Dockerfile best practices, regular updates, tags linked to Dockerfiles | Per-build vulnerability status |
| Verified Publisher | Commercial publishers Docker has verified | The publisher identity has been verified | Quality of any particular image, public verification criteria on the docs page |
| Docker-Sponsored Open Source | Open source projects Docker sponsors | The project is verified as trusted and active | Same as above |
| Community | Any user or organisation | Nothing beyond the account | Everything |
The Docker documentation also lists Docker Hardened Images as a trusted content group, described as minimal, production-ready images that Docker maintains. That is a separate, vendor-described program, so evaluate it on its own terms.
Choosing by use
Base operating system or language runtime: start with the official image. The set exists for exactly these cases, and the Dockerfile for each tag is linked.
A commercial product delivered as an image, such as a database or monitoring agent from its vendor: look for the Verified Publisher badge, and then check that the publisher name matches the vendor you are buying from.
An open source tool with its own project image: look for the Sponsored Open Source badge, and compare the repository link on the image page with the project's real site.
A community image: treat it as untrusted code until you have read its source, checked its update history and scanned it. If a trusted alternative exists, use that instead.
What every badge still needs from you
- A scan of the digest you will run.
- A non-root user and limited capabilities at runtime.
- A pinned digest in your build files.
- A scheduled re-scan.
Docker's own documentation on Image Access Management describes community images as public images from individual developers that may carry security risks, and puts them off by default for organisations that turn the control on. That framing is a useful default for any team: the badge buys you a lower starting level of suspicion, not an exemption.
A note on verification
The Docker trusted content page does not list the criteria for the verified programs, so avoid claiming more than the badge says. "The publisher identity has been verified by Docker" is safe wording. "The image has been security audited" is not something that page says.
Quick check
Is a Verified Publisher image safer than a community image?
The publisher is verified, which lowers one kind of risk. The image can still have vulnerabilities, so scan it either way.
Where do Sponsored Open Source images sit in an access policy?
In Docker's Image Access Management they are controlled under the community category, not as a separate one.
Safeguard scans the images you choose, records an SBOM, and applies your policies, whatever badge they carry. A free scan is at gold.safeguard.sh/scan.
Sources
- Docker Docs: Trusted content on Docker Hub
- Docker Docs: Image Access Management
- Docker Docs: Search Docker Hub
Last reviewed: 19 October 2026.
