RapidFort announced a new strategic partnership with GitLab to deliver hardened container images for GitLab regulated Self-Managed Deployments. The offering enables development and security teams to identify and eliminate vulnerabilities within the GitLab workflows they already use, without requiring changes to application code or migration to a proprietary operating system.
The partnership combines GitLab’s DevSecOps platform with RapidFort’s industry-first combination of minimal and near-zero CVE container images, attack surface management, and continuous runtime monitoring. The images retain GitLab’s existing functionality and version tags, so teams can adopt them without changing how they build and ship software.
“Regulated organizations need confidence in what they deploy and flexibility to meet their security requirements,” said Omer Azaria, VP of Product Management, GitLab. “Through our strategic partnership with RapidFort, regulated and air-gapped customers have a new way to get hardened, continuously patched GitLab images, along with audit-ready evidence, without slowing development.”
“This partnership is designed to let joint customers establish a golden image pipeline for GitLab – a single, centrally governed, hardened source of GitLab images that flows through the customer’s build, security scanning, and deployment stages,” said George Manuelian, Chief Strategy Officer at RapidFort. “It moves the industry from detecting vulnerabilities to eliminating them at the source, making secure-by-default software achievable at scale inside the platform where code is built.
“For self-managed customers, security doesn’t stop at the application layer,” said Martin Brümmer, Senior Product Manager, GitLab. “As AI accelerates vulnerability discovery, customers need to apply the same security scrutiny to the container images they use to deploy GitLab. This partnership gives customers a traceable path to hardened images and supporting security evidence.”
Today’s announcement builds on RapidFort existing public-sector work; it already publishes an optimized, hardened image for GitLab Runner Iron Bank, and compiles security benchmarks into audit-ready evidence for FedRAMP, Authorization to Operate (ATO), Cybersecurity Maturity Model Certification (CMMC), the EU’s Digital Operational Resilience Act (DORA), and the Cyber Resilience Act (CRA), while still moving at commercial development speed.
Under the partnership, GitLab’s on-premises images are now available through the RapidFort Curated Catalog, a library of more than 48,000 base and third-party container images spanning every major Linux distribution. Curated GitLab images will retain GitLab’s existing functionality, version tags, and configuration surface. Key characteristics of curated GitLab images from this partnership include:
● Near-zero CVE posture, updated daily. Images are continuously patched as upstream fixes land, with published SLAs of seven calendar days for Critical/High severity CVEs, 21 days for Medium severity CVEs, and 28 days for Low severity CVEs, once an upstream patch is available.
● FIPS 140-2/140-3 alignment. FIPS-validated OpenSSL providers (covering downstream consumers such as cURL) are built into applicable images, with images tested against a FIPS-enabled kernel helping customers meet a prerequisite for federal and defense deployments.
● Security Technical Implementation Guide (STIG)-hardened configurations. These reduce the manual effort security teams spend remediating baseline findings before GitLab can be authorized for use in regulated environments.
● Minimal attack surface. Hardened/community image variants strip out unused packages, shells, and debug utilities, reducing image size and CVE count well beyond the base curated image.
● Audit-ready compliance evidence. RapidFort’s Compliance and Remediation Tool (CART) component continuously validates images against security baselines and generates compliance reports usable in support of FedRAMP, CMMC, CRA, SOC 2, and CIS Benchmark assessments – reducing the manual evidence-gathering burden during ATO and audit cycles.
Availability
Multiple GitLab images are available immediately in the RapidFort Curated Images catalog, giving joint customers a ready-to-use starting point for hardened, on-prem GitLab deployments.
