RapidFort to Deliver Hardened Container Images for GitLab Regulated Self-Managed Deployments

RapidFort, the leader in Software Supply Chain Security (SSCS) with the largest distribution of curated truly open-source software, today announced a new strategic partnership with GitLab to deliver hardened container images for GitLab regulated Self-Managed Deployments. The offering enables development and security teams to identify and eliminate vulnerabilities within the GitLab workflows they already use, without requiring changes to application code or migration to a proprietary operating system.

The partnership combines GitLab’s DevSecOps platform with RapidFort’s industry-first combination of minimal and near-zero CVE container images, attack surface management, and continuous runtime monitoring. The images retain GitLab’s existing functionality and version tags, so teams can adopt them without changing how they build and ship software.

“Regulated organizations need confidence in what they deploy and flexibility to meet their security requirements,” said Omer Azaria, VP of Product Management, GitLab. “Through our strategic partnership with RapidFort, regulated and air-gapped customers have a new way to get hardened, continuously patched GitLab images, along with audit-ready evidence, without slowing development.”

“This partnership is designed to let joint customers establish a golden image pipeline for GitLab – a single, centrally governed, hardened source of GitLab images that flows through the customer’s build, security scanning, and deployment stages,” said George Manuelian, Chief Strategy Officer at RapidFort. “It moves the industry from detecting vulnerabilities to eliminating them at the source, making secure-by-default software achievable at scale inside the platform where code is built.

“For self-managed customers, security doesn’t stop at the application layer,” said Martin Brümmer, Senior Product Manager, GitLab. “As AI accelerates vulnerability discovery, customers need to apply the same security scrutiny to the container images they use to deploy GitLab. This partnership gives customers a traceable path to hardened images and supporting security evidence.”

Today’s announcement builds on RapidFort existing public-sector work; it already publishes an optimized, hardened image for GitLab Runner Iron Bank, and compiles security benchmarks into audit-ready evidence for FedRAMP, Authorization to Operate (ATO), Cybersecurity Maturity Model Certification (CMMC), the EU’s Digital Operational Resilience Act (DORA), and the Cyber Resilience Act (CRA), while still moving at commercial development speed.

Under the partnership, GitLab’s on-premises images are now available through the RapidFort Curated Catalog, a library of more than 48,000 base and third-party container images spanning every major Linux distribution. Curated GitLab images will retain GitLab’s existing functionality, version tags, and configuration surface. Key characteristics of curated GitLab images from this partnership include:

• Near-zero CVE posture, updated daily. Images are continuously patched as upstream fixes land, with published SLAs of seven calendar days for Critical/High severity CVEs, 21 days for Medium severity CVEs, and 28 days for Low severity CVEs, once an upstream patch is available.
• FIPS 140-2/140-3 alignment. FIPS-validated OpenSSL providers (covering downstream consumers such as cURL) are built into applicable images, with images tested against a FIPS-enabled kernel helping customers meet a prerequisite for federal and defense deployments.
• Security Technical Implementation Guide (STIG)-hardened configurations. These reduce the manual effort security teams spend remediating baseline findings before GitLab can be authorized for use in regulated environments.
• Minimal attack surface. Hardened/community image variants strip out unused packages, shells, and debug utilities, reducing image size and CVE count well beyond the base curated image.
• Audit-ready compliance evidence. RapidFort’s Compliance and Remediation Tool (CART) component continuously validates images against security baselines and generates compliance reports usable in support of FedRAMP, CMMC, CRA, SOC 2, and CIS Benchmark assessments – reducing the manual evidence-gathering burden during ATO and audit cycles.

Availability

Multiple GitLab images are available immediately in the RapidFort Curated Images catalog, giving joint customers a ready-to-use starting point for hardened, on-prem GitLab deployments. To buy or for more information, visit https://www.rapidfort.com/schedule-a-call.

About RapidFort

RapidFort leads the Software Supply Chain Security market with the largest distribution of curated, genuinely open-source software. Its platform enables organizations to eliminate risk at scale through hardened near-zero CVE container images, runtime profiling, attack surface management, and the industry's first independently malware-scanned open-source images – cutting CVE exposure by up to 99.9% without code changes or platform migration. RapidFort is recognized in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security, named a Gartner® Cool Vendor™, and honored as a Nutanix .Next Partner of the Year. The company is backed by Blue Cloud Ventures and Forgepoint Capital and headquartered in Sunnyvale, Calif. Visit www.RapidFort.com.

RapidFort, RAPIDFORT, and RBOM are registered trademarks of RapidFort, Inc. All other marks and names mentioned herein may be trademarks of their respective companies.

View source version on businesswire.com: https://www.businesswire.com/news/home/20261103372065/en/

The RapidFort GitLab partnership enables development and security teams to identify and eliminate vulnerabilities within the GitLab workflows they already use, without requiring changes to application code or migration to a proprietary operating system.