---
title: "ClickHouse on Docker Hardened Images"
description: "ClickHouse is now available as Docker Hardened Images (DHI), stripped-down builds for the ClickHouse server, ClickHouse Keeper, Kubernetes Operator and Helm chart, and metrics exporter. The standard image’s Ubuntu 22.04 base includes unused packages such as Perl, wget, and apt, whose known CVEs can block enterprise deployments even though ClickHouse does not use them. DHI replaces that base with a minimal image that has no package manager or network tools, runs as non-root, provides SLSA Level 3 provenance, and is maintained for CVE patching; Docker Scout reported 0 medium and 14 low findings for DHI, versus 8 medium and 11 low across 111 packages in the standard image. Migration preserves volumes and configuration, while development tooling remains available through a dev variant or temporary docker debug attachment."
---

# ClickHouse on Docker Hardened Images

[Clickhouse](https://yomu.fyi/company/clickhouse) · Jul 10, 2026

**Type:** Announcement

## Summary

ClickHouse is now available as Docker Hardened Images (DHI), stripped-down builds for the ClickHouse server, ClickHouse Keeper, Kubernetes Operator and Helm chart, and metrics exporter. The standard image’s Ubuntu 22.04 base includes unused packages such as Perl, wget, and apt, whose known CVEs can block enterprise deployments even though ClickHouse does not use them. DHI replaces that base with a minimal image that has no package manager or network tools, runs as non-root, provides SLSA Level 3 provenance, and is maintained for CVE patching; Docker Scout reported 0 medium and 14 low findings for DHI, versus 8 medium and 11 low across 111 packages in the standard image. Migration preserves volumes and configuration, while development tooling remains available through a dev variant or temporary docker debug attachment.

## Context

Enterprise vulnerability scanners inventory every package in a container image, so unused Ubuntu packages can produce CVE findings and block ClickHouse deployments. The post gives wget’s unpatched CVE-2021-31879 as an example and explains that teams may spend days investigating or requesting exceptions for tools ClickHouse never uses.

## Approach / What changed

Docker Hardened Images provide minimal ClickHouse builds without a package manager or network tools, run as non-root, include SLSA Level 3 provenance, and receive CVE maintenance from Docker’s security team. The catalog includes the server, ClickHouse Keeper, Kubernetes Operator and Helm chart, and metrics exporter. A dev variant and docker debug preserve access to extra tooling during development or troubleshooting.

## Takeaways

- Docker Scout reported 8 medium and 11 low findings across 111 packages for the standard image, compared with 0 medium and 14 low findings for the DHI image.
- The hardened ClickHouse server image keeps volumes and configuration compatible, but uses the dhi.io/clickhouse-server:26.2-debian13 image reference and may require CLICKHOUSE\_PASSWORD for network access.
- DHI images remove common debugging and package-management tools from production images; a dev variant and docker debug provide those tools without rebuilding the hardened image.

**Tags:** [Deployment](https://yomu.fyi/topic/deployment), [Docker](https://yomu.fyi/topic/docker), [Kubernetes](https://yomu.fyi/topic/kubernetes)

- Source: [Clickhouse](https://clickhouse.com/blog/docker-hardened-images)
- Source URL: https://clickhouse.com/blog/docker-hardened-images
- Ingested by Yomu: 2026-08-29T01:38:20.160Z

[Read original post](https://clickhouse.com/blog/docker-hardened-images)