Hardened images are container images that are intentionally stripped down to include only the packages, libraries, and tools an application needs to run. By removing shells, package managers, debugging utilities, and unnecessary services, they reduce inherited software and shrink the attack surface available to an attacker.
This matters in CI/CD because every extra component in an image can carry vulnerabilities, misconfigurations, or abuse paths into production. Hardened images help defenders limit what can be exploited if a container is compromised, and they make supply-chain review simpler because there is less code to inspect and patch. In practice, attackers often abuse oversized base images to find known flaws or useful tooling already present; hardened images deny them that foothold and support stronger baseline security across builds and deployments.