--- title: Intel and Canonical to secure containers software supply chain description: Intel and Canonical publish secure and stable OpenVINO container images based on the Ubuntu ecosystem for AI/ML developers. Trusted OCI images for a secure software supply chain. url: https://canonical.com/blog/secure-containers-supply-chain-intel-openvino-canonical?format=md --- 1. [Blog](https://canonical.com/blog) 2. Article --- [Valentin Viennot](https://canonical.com/blog/author/valentinviennot "More about Valentin Viennot") 10 November 2021 # Intel and Canonical to secure containers software supply chain [containers](https://canonical.com/blog/tag/containers) [docker](https://canonical.com/blog/tag/docker) [Intel](https://canonical.com/blog/tag/intel) [machine learning](https://canonical.com/blog/tag/machine-learning) [OpenVINO](https://canonical.com/blog/tag/openvino) [Security](https://canonical.com/blog/tag/security) --- Share the article **Intel and Canonical collaborate to build and publish OpenVINO™ container images based on the Ubuntu ecosystem. This work aims to provide trusted, secure, and developer-friendly container images for AI/ML applications in many industries.** ## The provenance challenge facing cloud software Today, cloud-native developers benefit from an abundance of resources to compose their applications. With [container images](https://canonical.com/containers/what-are-containers), packaging all these resources in a standard, easy-to-reuse format is now easier than ever. Unfortunately, container images also make it easier to package unneeded, vulnerable software or even malicious resources. Knowing which resources to use and what is a safe base layer when starting a cloud-native project is challenging. Extreme caution should go into picking these dependencies deliberately. Organisations need to provide their developers with “sane defaults”, trusted sources to underpin and support applications. To help developers solve this issue, [Intel](https://intel.com/) and [Canonical](https://canonical.com/) worked together to provide a set of secure and stable [container images](https://hub.docker.com/u/openvino) for the OpenVINO and OneAPI ecosystem, based on [the Ubuntu base image](https://hub.docker.com/u/ubuntu) and software. This effort supports developers in packaging Machine Learning (ML) and Artificial Intelligence (AI) models to deploy from the cloud to the edge. ### oneAPI The [oneAPI specification](https://www.oneapi.io/) provides an open, industry standard, cross-architecture software stack for CPU and accelerator architectures (GPUs, FPGAs, and others). The oneAPI programming model simplifies software development and delivers uncompromised performance for accelerated compute without proprietary lock-in, while enabling the integration of legacy code. This enables a common cross-architecture developer experience for faster application performance, increased developer productivity, and greater innovation. With oneAPI, developers can choose the best accelerator architecture for the specific problem they are trying to solve without needing to rewrite software for the next architecture and platform. ### Intel OpenVINO [OpenVINO™](https://software.intel.com/openvino) is an open-source toolkit for optimising and deploying AI inference. With OpenVINO, developers can run high-performance inferences with a write once, deploy anywhere efficiency using the Intel® Distribution of [OpenVINO™ toolkit](https://www.intel.com/content/www/us/en/developer/tools/openvino-toolkit-download.html). OpenVINO is powered by oneAPI using the [Intel® oneAPI Deep Neural Network Library](https://www.intel.com/content/www/us/en/developer/tools/oneapi/onednn.html) (oneDNN), a library of performant building blocks for deep learning applications that accelerates performance. OpenVINO unlocks your cloud’s true potential: * Boosting deep learning performance in computer vision, automatic speech recognition, natural language processing and other common tasks. * Using models trained with popular frameworks like TensorFlow, PyTorch and more. * Reducing resource demands and efficiently deploying on a range of Intel® platforms from edge to cloud. ### Canonical LTS Container Images In response to the provenance challenge in OCI images, Canonical announced [a program](https://canonical.com/security/docker-images) to provide hardened application container images for popular open source software with up to 10-year guaranteed security updates. This program is based on years of [security expertise](https://canonical.com/security) maintaining the Ubuntu operating system and cloud foundations software. Similar to this initiative, Canonical works closely with its partners to provide end-users with quality Ubuntu-based container images that can provide both security and stability, as well as an outstanding developer experience. ## Secure and stable container images Building secure and stable OCI images starts from the choice of a base image. What could seem like a harmless initial decision will have long-term consequences. In fact, most of the software contained in OCI images actually comes from this layer #0 choice. They provide the foundation for applications to run: shared libs – like SSL and libc – and they enable developers to focus on the upper application layer. The Ubuntu base image is [the ideal foundation](https://juju.is/cloud-native-kubernetes-usage-report-2021#selection-criteria-for-container-images) for OpenVINO and oneAPI based software: * Regular updates, content watched and quickly patched for security vulnerabilities, and commercial maintenance commitment. * Large secure and stable software ecosystem from the Ubuntu archives. * Developer-friendly: making developers’ lives easier reduces risks. This close collaboration between Canonical and Intel ensures direct and fast updates, as well as a [support](https://canonical.com/security/docker-images#get-in-touch) option with the base image and software. ## Making developers’ lives easier “Secure” software tends to make developers’ lives more difficult, with a lot of complex configurations and validations. While it might sound counterintuitive, sometimes less is more. Indeed, hard-to-use software will often lead developers to use workarounds and bad practices in order to get things done. Similarly, if patching is hard, it won’t happen as often as needed. To avoid security liabilities related to bad practices, it is critical to provide developers with the best experience possible. With this set of Ubuntu-based container images, not only does it provide a best-in-class developer experience, it also provides a consistent and familiar environment for cloud and AI developers. --- Are you a developer interested in using these oneAPI-based OpenVINO containers based on Ubuntu images? Don’t miss [part 2](https://canonical.com/blog/how-to-colourise-black-white-pictures-openvino-containers-part-1) and [3](https://canonical.com/blog/how-to-colourise-black-white-pictures-openvino-containers-part-2) of this blog series for a deeper dive into these technologies. * Watch our **on-demand webinar** about [secure AI models deployment at the edge.](https://ubuntu.com/engage/webinar-ai-containers-edge-deployment?utm_medium=blog&utm_campaign=7014K000000UVU9) * Continue [reading the series](https://canonical.com/blog/how-to-colourise-black-white-pictures-openvino-containers-part-1), introducing the demo “How to colourise black and white images with OpenVINO on Ubuntu containers” Keep reading, [part two](https://canonical.com/blog/how-to-colourise-black-white-pictures-openvino-containers-part-1) is live! ## Sign up for our newsletter Get the latest Canonical news and updates in your inbox. Work email: \*I agree to receive information about Canonical's products and services. By submitting this form, I confirm that I have read and agree to [Canonical's Privacy Policy](https://canonical.com/legal/dataprivacy). Sign up ## Share on --- ## Related posts [### Canonical joins the Open Secure AI Alliance](https://canonical.com/blog/open-secure-ai-alliance) Canonical is now part of the Open Secure AI Alliance, announced by NVIDIA with partners across cloud computing, cybersecurity, enterprise software, open source foundations, and... [Canonical](https://canonical.com/blog/author/canonical) 28 August 2026 [### Januscape vulnerability CVE-2026-53359 mitigations available](https://canonical.com/blog/januscape-linux-vulnerability-mitigations-available) Introduction A local privilege escalation (LPE) vulnerability affecting the Linux kernel was publicly disclosed on July 6, 2026. The vulnerability was assigned CVE ID... [seth-arnold](https://canonical.com/blog/author/seth-arnold) 11 July 2026 [### DirtyClone Linux kernel local privilege escalation vulnerability fixes available](https://canonical.com/blog/dirtyclone-linux-vulnerability-fixes-available) On June 25, 2026, JFrog published their research into CVE-2026-43503, referring to the vulnerability as DirtyClone. The vulnerability had previously been responsibly disclosed... [Luci Stanescu](https://canonical.com/blog/author/lucistanescu) 1 July 2026 [### pedit COW kernel local privilege escalation vulnerability mitigations](https://canonical.com/blog/pedit-cow-linux-vulnerability-fixes-available) Mitigations are available for the Linux vulnerability with CVE ID CVE-2026-46331. The CVE ID was assigned on June 16 2026 and highlighted as a local privilege escalation (LPE)... [Luci Stanescu](https://canonical.com/blog/author/lucistanescu) 1 July 2026