This week I ran helm show values on the Apache Airflow chart, version 1.22.0, released in June. The bundled PostgreSQL points at bitnamilegacy/postgresql, tag 16.1.0-debian-11-r15. The image labels say it was built on November 30, 2023, on Debian 11, and Debian 11 left LTS on August 31.
That image is there on purpose. A year ago Bitnami shut most of its free catalog and said running it cost too much. Eleven weeks later Docker gave its hardened images away under Apache 2.0, and by August 2026 a startup that matched that price had announced its shutdown.
September 29, 2025: the tags disappeared
Broadcom posted the notice on July 16, 2025, in bitnami/containers issue #83267. On August 28 Bitnami stopped publishing Debian-based images and OCI charts to Docker Hub, then ran brownouts through September.
The cut came on September 29. That morning someone filed an issue because docker.io/bitnami/kafka had no tags at all. The maintainer replied that Kafka wasn't in the trial set: about 40 images and 10 charts stayed free, latest tag only, for development. Versioned tags were frozen in docker.io/bitnamilegacy. Production moved to Bitnami Secure Images, rebuilt on VMware's Photon OS, with no public price; press coverage put it at $50,000 a year and up.
The reasoning came in a Broadcom community post on August 18: "Bitnami has been the Jenkins of the internet for many years, but this has become unsustainable. Operating a build pipeline and OCI registry for the general public is very expensive."
AWS dropped its 317 Bitnami repositories from ECR Public on June 10, 2026. Today docker.io/bitnami/postgresql has no version tags, only latest, which is PostgreSQL 18.6 on Photon OS 5.0:
$ docker pull bitnami/postgresql:16.4.0
Error response from daemon: manifest for bitnami/postgresql:16.4.0 not found: manifest unknown: manifest unknownLinks
December 17, 2025: Docker gave its images away
Docker launched Docker Hardened Images on May 19, 2025, as a paid product with a 7-day patch window for critical and high CVEs. When Bitnami users went shopping that August, Docker called DHI "affordable and transparent", which still meant a trial and a sales conversation.
On December 17 more than 1,000 images and Helm charts went free under Apache 2.0, served from dhi.io. A Docker account is the entry ticket; an anonymous token request to dhi.io comes back Unauthorized. Unlike Bitnami's leftovers, the free tier keeps versioned tags such as python:3.13. Select and Enterprise hold the SLA and the FIPS and STIG variants, and Enterprise alone gets five years of Extended Lifecycle Support past upstream end of life. The public definitions repo held 595 image definitions and 96 charts when I counted this week.
One developer quoted by DevClass wasn't sold: "It's free for now, just like registries were 'free' and docker desktop was free... until they weren't."
Links
2026: everyone priced against zero
Chainguard had the most to lose and moved the least. Its free images at cgr.dev/chainguard need no login but ship as latest and latest-dev only, a set it trimmed in November 2024. Anonymously, python:latest resolves for me and python:3.12 returns 404. In December CEO Dan Lorenc told TechTarget he'd be "pretty cautious" about Docker's offer. On March 17, 2026, Chainguard launched Catalog Starter: five images of your choice, all supported versions, production use allowed, no CVE SLA, corporate email required.
Red Hat followed on May 12 with Red Hat Hardened Images, a no-cost catalog of more than 45 images.
Minimus went furthest. On June 23 it opened its whole catalog, every major and minor version, no registration. By late August its homepage said the reg.mini.dev registry switches off on October 22. Echo bought the technology on August 27 and told TechTarget it would keep the platform running. Chris Hughes of Noma Security told the same outlet: "Everyone kind of raced to 'out-free' each other."
Links
What "near-zero CVEs" counts
Every catalog above advertises near-zero CVEs, so I went looking for the denominator. Docker's number is what a scanner reports after applying Docker's own VEX statements. A CVE Docker judges unexploitable gets not_affected with a justification, and a backported fix without a version bump gets not_affected plus inline_mitigations_already_exist. Docker's docs warn that scanners without VEX support report more. The Grype example in those same docs, VEX applied, still shows a High perl CVE marked won't fix.
Chainguard publishes its triage as security advisories in wolfi-dev/advisories and secdb feeds that scanners consume. Its docs say plainly that a CVE count depends on build age, and show an October 2024 jre digest scanning dirty. The paid SLA clock starts once a qualifying patch exists: seven days for critical, fourteen for everything else.
The honest reading of zero is a fresh build scanned by a tool that accepts the vendor's triage. Pin that digest for six months and you run a six-month-old image with the same badge.
Links
What teams did with their charts
On September 18, 2025, mid-brownout, Airflow merged "Temporary fix to Bitnami psql chart licensing issues", which swapped in the official postgres:13 image, a major-version downgrade from 16. In January 2026 a follow-up put back the exact Bitnami image, now from the archive: "It's likely users of the provided postgres moved to this image anyways." Mastodon pointed its Bitnami subchart images at bitnamilegacy in October 2025. Superset did the same on May 4, 2026, "until we can switch over to Valkey and vanilla Postgres."
GitLab split it. The company's infrastructure team parked its Redis caches on bitnamilegacy/redis as a short-term fix, while the product chart removed bundled Bitnami PostgreSQL and Redis in GitLab 19.0 on May 21, 2026, "with no replacement", and the migration guide points at CloudNativePG and Valkey. Langfuse's chart 2.0.0, out August 18, replaced Bitnami Redis with the official Valkey chart and Bitnami Postgres with groundhog2k/postgres. The Valkey issue covered where that chart came from.
The advice from both ends of the removal was mirroring. A Bitnami maintainer told one user to copy an image "to your own registry before the final removal." AWS, retiring its own copies, wrote: "Never point production workloads directly at a public registry you don't own." A mirror with digest pins trades a tag that vanishes for a digest that never changes, and someone still has to move the pin.
Links
The recipe was never the expensive part
Bitnami's Dockerfiles still sit in bitnami/containers under Apache 2.0, with commits from this week. Anyone can build them. Broadcom's complaint was about running "a build pipeline and OCI registry for the general public", and the vendors doing that for free in 2026 have something else to sell next to it. Docker has subscriptions and Red Hat has RHEL; Minimus had only the images.
Until somebody opens the next PR, Airflow's chart will keep pulling a Postgres build from November 2023.
Questions? Feedback? Reply to this email. I actually read them.
Ilia