I don't want to discount the work they are doing, and that it has no value, but a little bit shocking that they expect to go all commercial with this, in the Oracle way, while just "packaging" and so relying on open source software that they will not contribute to.
Also, I'm a little bit wondering at how much all of this is really copyrightable in the end.
Because if you keep it private I understand, but here it is basically for each package just a few lines, recipes to build the components that they don't own. Like trying to copyright the line "make build".
And it might be each the single and obvious way to package the thing anyway.
And speaking at the built artefacts, usually a binary distribution of third party open source software with common license should preserve the same rights to the user to access the source code, the instructions to build, and the right to redistribute...
"Makefile" they have written and copyrighting is very non trivial and there are many man-months of effort. Configuring all sorts of software just with env vars and make it usable is not an easy feat.
Not everything that's authored and published is eligible for copyright. Copyright applies to only the creative elements of a work that are unique. Things that are facts, or are necessary for function are not copyrightable.
They likely hold a copyright on the exact expression of their documentation, but the facts and information in that documentation, and necessary configuration such as port numbers, and dependency selection are not subject to copyright.
What probably carries more value is the helm charts that they provide which are also on their way out.
The images themselves have official replacements (for example, looking at https://hub.docker.com/u/bitnami why wouldn’t I use Node or Postgres images from the official sources instead).
I have no idea how many people actually used their helm charts though.
They do keep some of them more up to date, for example the bitnami python image had system packages patched faster than the official one. But if you are willing to pay then chainguard is a better solution.
Some other open source projects have also shipped Bitnami software in their own helm charts, i.e. APISIX's etcd instance is the Bitnami chart pulled in as a dependency.
Not that it ever worked well, we had to scale it to 1 because the quorum would constantly break into unrecoverable states.
> However, in order to sustain and support the dedicated team of engineers who maintain and build new charts and images, a subscription will be required if an organization needs the images and charts built and hosted in an OCI registry for them.
This is such a naive take. Bitnami images were a sign of goodwill, a foot in the door at places were the hardened images were actually needed. They just couldn't compete with the better options on the market. This isn't a way to fix it, it's extortion. This is the same thing Terraform Cloud did, and I don't think that product is doing so hot.
> Essentially, Bitnami has been the Jenkins of the internet for many years, but this has become unsustainable.
It's other people's software, so it's very rich of Bitnami to accuse anyone of freeloading when their only contribution is adding config options to software that maybe corresponds to a level 2 on the OperatorFramework capability scale[1] - usually more of a 1.
> It's other people's software, so it's very rich of Bitnami to accuse anyone of freeloading when their only contribution is adding config options to software
I'm not going to defend a corporation but this sentence feels very entitled. They were providing it for free, you could use it. They are not going to provide it for free anymore, you migrate to something else or self-maintain it and say "thank you for the base work you did I can use now"
Aye, It's a bit like saying you can't sell your code, because you wrote it in someone elses software.
Writing a decent Dockerfile isn't hard, and keeping it maintained and working with new versions is still work and it's past the wheelhouse of very many people. It's entirely reasonable to want paid for that effort.
That said, it's not work I personally value enough to put my hand in my pocket, and that's a fair take too.
When a project is abandoned, when updates are slow, when features people want are not being released, when tracking upstream dependency updates are delayed, sure, you are not entitled to anything and I’ll be the first one to say get off your butt and contribute. In the other hand when you engage with the community for years under an OSS/free context then once the community has invested in your project, learning it, creating learning resources for it, integrating it into their own projects, and you never communicated your intention to “wait until it gets big then then pull the rug” it feels like a disingenuous bait and switch. The reason it feels that way is because it is a disingenuous bait and switch. This is even more so the case when you built your project on top of other projects.
I have no problem using a paid product or service or paying for support on a OSS product, but will never pay one of these bait and switch scams a dime, no matter how much engineering effort it takes.
I think it's perfectly fair for them to say "we're not doing this any more". The sketchy part is deleting the public registry at docker.io/bitnami rather than just no longer updating it. Why can't docker.io/bitnami become the 'legacy' registry, receive no future updates, so at least folks who don't hear this news won't have pulls suddenly fail?
edit: like if I have a package on NPM and I want to stop offering it, I think it's shitty to just delete it. That breaks builds.
Vendor lock-in is a thing. Switching costs are a thing. They know this. That's the whole business model. They're expecting that the cost of switching to outweigh the cost of the subscription.
I get that this business model is fashionable amongst wannabe rent-seekers, but it's still antisocial and should be shunned.
Reminds me of a joke, where there was a beggar sitting on a street next to a certain office, and one man has been giving him a coin every time he went to work or was going home. That continued for a while, until one day the man says to the beggar - "you know, I've been giving you a coin twice a day for a while now, but now I am getting married, it's an expensive thing so I can't give as much anymore, I only will be giving you a coin once a day from now on". And the beggar cries out: "Look at this putz, he's getting married and now I have to feed his whole family!"
What do you mean, that's the business model more than half the VC-funded startups now. Provide something for free or near free, wait until your customer is dependent on you and/or consolidate into at least an oligopoly and then put the thumbscrews on.
I find that to be a pretty dishonest business model. I don't have any Bitnami images to replace, but I know a lot of people who do without ever having made that choice - and their bosses aren't going to pay Broadcom for the most part either. So you end up with overworked developers that now hate Broadcom and/or a whole lot of deployments that just break or never get updated. The number of people going "I can just switch over to the archive image, whatever" on the K8s subreddit alone is concerning.
>This is such a naive take. Bitnami images were a sign of goodwill, a foot in the door at places were the hardened images were actually needed. They just couldn't compete with the better options on the market. This isn't a way to fix it, it's extortion. This is the same thing Terraform Cloud did, and I don't think that product is doing so hot.
You seem to be confused about who Broadcom is and how they operate. "Long term health" isn't a thing for them. They buy products that are embedded deeply in the fortune 500, cut 90% of the staff, and increase licensing and support 2-100x. They do not care if you are upset. They do not care if you're going to "find something else". They don't care if you build an entire campaign to decry what they're doing.
They know the F500 cannot easily remove them, and that they will have at minimum 5 years to print cash on their service contracts. Sure, some of those F500s will sue them and try to stop the extortion via legal means, but they know that they'll either win, or at worst still be allowed to jack up prices even if a court rules it's not their original egregious asking price.
Building Infrastructure company is challenging in 2025. Previously, you would prioritize traction among developers over focusing on revenue.
But that does not work in 2025. You are expected to make money from the get-go and are left with only enterprise customers and boy, that category is hard, as everyone is competing for that slice.
> Previously, you would prioritize traction among developers over focusing on revenue.
A.k.a. using open source as a marketing tactic to lure in customers, only to do a rug pull once the business gains enough momentum.
> But that does not work in 2025.
Good. It is an insidious practice. There are very few projects that actually do this properly without turning their backs on the users who made their products popular in the first place.
> You are expected to make money from the get-go and are left with only enterprise customers and boy, that category is hard, as everyone is competing for that slice.
The strategy of delivering valuable products that benefit users without exploiting them has always existed. The thing is that many companies choose the greedy and user hostile path, instead of running a sustainable business that delivers value to humanity and not just to shareholders, which is much more difficult. So I have no sympathy towards these companies.
The problem I think is that all the easy infrastructure problems have been solved and the market is crowded with those solutions. Solving the hard problems is probably where you could have a viable business but I don't really see that many companies trying to solve those:
* Making mono-repos work for large companies.
* Mixed language builds are still a ci/cd unsolved problems for most companies.
So, you're saying in 2025 businesses are expected to actually make money? What a novel concept. Will the wonders ever cease? I mean, you could expect that thing where you borrow incessantly to "gain traction" and "produce growth" but never produce any returns on it to run for a bit, especially in a new field where becoming #1 is at premium. But it has to stop somewhere. So it looks like somewhere is here.
If their contribution is minimal then the impact of this change should also be? But it appears it disruptive so they have been showing up for a long time and that’s one of the most difficult things.
That's like saying, "Honda isn't a car company, they're an assembly company because they don't mine the minerals to make the parts and rely instead on supply chains"
In the end, they have to do it because of the CSR, and they can do it because of the CSR.
The European Union Cyber Residence Act has the potential to drastically change the open source ecosystem.
The new regulation pushes the due diligence for security according to the Act towards any entity making a commercial offer based on open source software.
Caveat emptor!
For any enterprise, that means that they either do extensive documentation and security on open source components they use or they use foundation or enterprise-backed products.
Note that pure uncommercial open source projects are exempt from the Act.
I see this as a chance; we can still create open and free software, and those of us who desire financial compensation from those who make money with their work can offer as a necessary compliance framework as a service via a different entity.
I don't agree, they have to do all the CSR due diligence for the commercial offerings based on those open source projects, so there is no difference. The effort has to be done regardless if there's part of it that is open source and free, or not.
They don't have to. They can do the paid secure images for the commercial offerings and keep the other ones free. Or they could free the secure images for everyone if they feel like that.
Hmmmm, I'm not sure that's how it would be read. If there's any 'associated commercial activity', it falls under the CSR, even if the images themselves are free and open source.
(That said, the overhead of the CSR is really not much, from what I can tell. It's pretty lightweight as EU standards go)
If you’re looking for an alternative here, we (the team that built Twistlock) launched Minimus a few months ago to provide near zero CVE images built continuously from source. We have long experience in this space (we even wrote NIST SP 800-190) and I’d love to talk if we could help anyone. We also have drop in replacement images and charts for Bitnami, as we describe here: https://www.minimus.io/post/the-bitnami-pricing-changes-what...
If anyone has tech questions about how it all works, tools we use, customer scenarios, etc I’d be happy to discuss.
Also, this form is nonsensical https://www.minimus.io/get-started#signup-form because it distinguishes between "Individual" and "Organization" but then Company is a mandatory field. Maybe just go ahead and label it "Lead Gen / Ask For A Demo"
Not that anyone cares, but I can confirm this is the case: the response is an email from some marketing person asking to "have a call" and then a few days later my email gets some random spam from being subscribed to every mailing list they own. What a farce
Let me rewrite the comparison used in the "Example: Using Bitnami vs. Minimus" section of the blog post:
Using Bitnami Secure Images:
You pull a versioned PostgreSQL image built on a minimal-attack-surface OS (Photon). When a CVE is disclosed or a new upstream version is released, Bitnami’s automation takes care of everything: a new container image (and Helm chart, if applicable) is built, tested, and published to your registry within hours.
All you need to do is update to the latest version; no manual CVE monitoring, triage, or patching required.
The main question as always is price. I was also interested in things like Chainguard and Docker secure images until I had a sales call with them and found out the price.
I can’t seem to find the price anywhere on your site… I assume the reason for that is that it’s also nearly impossible for a non-fortune 500 to afford?
Nope - we're early stage so we're really flexible not just on pricing but licensing terms too. We have many customers that are smaller startups, not just typical F500 types.
Please offer an implementation of the docker-credential helper, just like chainguard does with docker-credential-cgr[1], and don't put throwaway text that says "docker supports credential stores, so good luck to you" on your website https://docs.minimus.io/foundations/authentication#using-a-c...
> BSI is effectively democratizing security and compliance for open source so that it doesn’t require million-dollar contracts from vendors with sky-high valuations.
I suppose 50k isn't a million dollar contract, but it's certainly also not "democratizing" anything
Depending on your needs, this could be a bargain as advertised. It's only expensive relative to what you can build on your own, or what competitors offer.
It's a bit tricky to work through all the jargon, but it's my understanding that they are simply pulling the mass of things that they provide for free. You can still get the Docker files for their offerings (not sure they offer all tags though?") and you can even use the images from Docker Hub.
But. What they are offering is considered "development" regardless of what you are using it for? In other words, NOT a production environment, because they aren't giving you a production environment (or at least what they define as a production environment.) What they give you for free is the "latest" and on a Debian system.
What they offer as "secure" is running on Photon OS and goes through a security pipeline, etc. They aren't holding anything back aside from the services they provide.
My team is worried about that too. We've been a java and spring shop for years. We're looking at micronaut, it's similar enough.
When I had someone from another team take a look at broadcom and what they could do to spring, they said the licenses are permissive, it will be fine. Likely not that simple.
They're still technically Avago Technologies, just wearing the name of Broadcom after the acquisition in 2015-2016. Not sure if there's much of Broadcom left, beyond the name and what IP they had at the time which was not sold off, like they did with the IoT related IPs.
Taking a bunch of projects and making containers and flexible helm charts for them is kind of an interesting model. It’s what Redhat and Canonical do with raw Linux packages; they charge for premium support and even patches or extended support.
I was going through one of my clusters, I have two bitnami uses and they are both ‘building blocks’ I use Trino, which uses a metastore which uses postgresql and then some other package uses redis. It seems like both postgresql and redis could/would have containers and charts to install their stuff, where it breaks is the postgresql guys probably want to support “current” and not 4 major releases back, which is kind of normal to see in the wild.
It is kind of an interesting model, I’d love it if rancher or openshift or someone started to seriously compete. Shipping a Kubernetes in a box is nice but if they started packaging up the building blocks, that’s huge too.
Broadcom has always been about pure evil (cough capitalism cough), you just haven't been affected by it before. Ask anyone who's worked with their hardware...
So
Others have already provided good answers. I wouldn't classify it as evil if all they did was to stop maintaining the images & charts, I recognise how much time, effort and money that takes. Companies and open source developers alike are free to say "We can no longer work on this".
The evil part is in outright breaking people's systems, in violation of the implicit agreement established by having something be public in the first place.
I know Broadcom inherited Bitnami as part of an acquisition and legally have no obligation to do anything, but ethically (which is why they are evil, not necessarily criminal) they absolutely have a duty to minimise the damage, which is 100% within their power & budget as others have pointed out.
And this is before you even consider all the work unpaid contributors have put into Bitnami over the years (myself included).
The images are currently in Docker Hub. If $9/month (or $15, not 100% sure if $9 includes organizations) to keep those images available is too much for Bitnami I'm sure there are many organizations who wouldn't mind paying that bill for them (possibly even Docker Hub itself).
Broadcom is deciding to host it on their own registry and bear the associated cost of doing so. Not sure what this has to do with sponsoring network egress
I advocated an enterprise to migrate away almost two years ago now. In enterprise time that means the project to do so is just about complete, so I am feeling pretty vindicated just now.
I was never a fan of images from Bitnami. They always used complicated entrypoint and setup scripts, and introduced weird quirks to the software. More than once have I experienced issues or ran into configuration limitations with Bitnami images that didn't exist in official ones.
So good riddance, as far as I'm concerned. I recommend anyone to avoid using them, and switch to official images or to build them yourself if they're not provided. That's the more secure approach, anyway.
I concur. There was supposedly a migration path from their postgresql image & chart to the postgresql-ha image & chart.
Aside of having to re-mount the data disk and move things around manually; the -ha chart has numerous other issues where it always requires the master to be node-0. And with pods being rescheduled within a statefulset, good look having the master be on node-0. If there was an outage and the master is anywhere else, node-0 will just 'wait' for a master to come online, time out and shoot itself in the head thinking it is in a network partition and that retrying may help.
The algorithm implemented by postgresql-ha turned out to be plain broken. Only able to survive pods neatly shutting down.
Sometimes, over engineered approaches are necessary to make older software work with environment variables and configmaps, because said software is still designed for traditional VM deployments.
The way I see it, a software project has only (1) code you maintain or pay someone to maintain for you, and/or (2) throwaway code that you will eventually need to replace with an incompatible version.
Nothing wrong with a project that is just gluing throwaway code because it's a gamble that usually pays off. But if that code is from third-party dependencies, just don't believe for a second that those dependencies (or any compatible forks) will outlive your project, or that their developers have any incentive at all to help you maintain your project alive.
It is sad to see how Broadcom cannot do padding right for mobile…
But on topic: why not create docker.io/bsi and let /bitnami as is without new updates? Then nothing breaks; it just won’t be possible to do upgrades. You’ll then figure out why and possibly seamlessly switch to your own build or BSI.
> But on topic: why not create docker.io/bsi and let /bitnami as is without new updates?
If people are relying on you for automatic security updates, and you've decided to no longer provide these updates [for free], users should opt in to accept the risk.
This would normally require user action (after a period of warnings/information), and having the fix look 'obviously' unsafe (`/bitnami ` ->`/bitnamilegacy`) feels reasonable.
Any brand value that bitnami has will be entirely destroyed by this incomprehensible change. People will associate the ‘bitnami’ namespace with “can’t possible utilize for long term production use”
I never understood the point of Bitnami. Every time I tried one of their image / package, it's a complicated mess full of custom and strange stuff, really hard to work with.
Instead of a simple package of the software based on some familiar base, you get some weird enterprise garbage that follows strange conventions and a nightmare when you need to customize anything.
100% agreed. I don’t understand the point of throwing all conventions out the window and building their own brittle scripts on top of it. All their images require docs to configure because none of the upstream documentation applies.
I've used them as a quick way to get rootless configured base images. Not sure if official repos provide those now, but it used to be a big hassle to get things like postgres images running without root in their containers. Although I often had to read through their dockerfiles to figure out the uid setup, where configs live, etc because they were not consistent between the various bitnami images.
Back in the day, Bitnami was a way to run Wordpress on Windows. They packaged it nicely so that you could install it on Windows Server. Nowdays that could get you fired, but back then Linux was not so widespread.
What are some resources for these conventions? As far as I can tell everyone else rolls their own bespoke images based off of of a projects image in order to customize the configuration.
At my last gig I avoided Bitnami container images and Helm charts wherever possible. We (me plus an AWS consultant) used Karpenter Autoscaler, Envoy Gateway API, Gatekeeper OPA, Loki/Prometheus/Grafana Stack, EDB Postgres Operator, ... and deployed all through a single comprehensive terraform script to an EKS cluster. I tried to keep reliance on one single company as low ad possible. I even had a Plan B to replace S3 with MinIO in case the company decided to move to another cloud provider or an On Prem Kubernetes cluster.
My recommendation to everyone is to avoid Cloud Vendor Lock-In from the start, and even if it's more initial work, to try to have as much as possible running on Kubernetes.
Good to see they decided to delay a bit and do some brownouts first. I took a quick look at the Docker hub stats (https://raesene.github.io/blog/2025/08/21/bitnami-deprecatio...) and it looks like some of those images are still getting hundreds of thousands or even millions of pulls a week.
Thanks for mentioning these! Do you know what are the official channels they're doing the announcements in? In the post they just mention the word "usual" with no clarification.
Meanwhile if anyone wants images with dramatically higher supply chain security than anything Bitnami ever offered, and free to the public forever, check out stagex.
As the only multisigned, full source bootstrapped, reproducible, and container native distro that exists, it does not matter what registry you pull from because the digest is the same everywhere.
We publish all images to both dockerhub and quay and signature checks pass either way so mirror anywhere you want.
Anyone claiming they need to host in a particular registry for security is gaslighting you.
They absolutely did, and beat us to it. They were a fantastic reference, and we link to their blog posts in our readme. We even have a comparison with Guix there too.
Guix optimized for maximizing package and architecture variety quickly and focused on retrofitting supply chain security tactics as a secondary goal later where possible. For example it allows for untrusted packages with binary blobs in the supply chain in cases like Haskell, Ada, and Qemu. Their supply chain security efforts are on a package by package basis and not mandatory, and still assume that all maintainers are unable to be compromised.
Stagex by contrast is a supply-chain-security-first distro that can trust no single maintainer or computer by design. As such, Haskell and Ada are impossible to add support for right now as no bootstrap path exists for them.
With Qemu we did the hard work of learning how to build all those binary blobs ourselves from source because we really needed it.
Guix has by far the best supply chain security of any workstation distro out there, but I would never ever use it in the supply chain of anything bound for high value production use where no single person should be trusted. Guix is also very difficult to use in container environments as it has no signed/reproducible OCI images so you would have to build all that yourself.
Commonly used in microcontrollers to describe supply voltage dropping below threshold. It could cause RAM corruption, erratic behaviors of robots, overshoot in voltage regulators, battery fluid leaks etc., and so optional detection features are often made available to reset or stop the processor and notify the application on next boot.
It's also used in utility power supplies to describe line voltage going below spec. It's considered a dangerous condition in that context too, as lots of non-smart equipment tend to run at higher amperage at lower voltage and/or fail to start/run and catch fire.
We did this at stripe when deprecating TLS 1.0, and called it a brown out (I don't know the origin of the term in software).
You do it when you have a bunch of automated integrations with you and you have to break them. The lights arent on at the client: their dev teams are focused on other things, so you have to wake them up to a change that's happening (either by causing their alerting to go off, or their customers to complain because their site is broken)
There was actually a really terrible brown-out by Poetry (a Python dependency management and packaging tool) where they introduced sporadic failures to people's CI/CD systems: https://github.com/python-poetry/poetry/pull/6297
It refers to a situation where a system is deliberately designed to fail (usually for short periods of time), to still provide some level of service while alerting others that the system is soon to be turned off.
That is not where the term comes from. Lights out -> Blackout (WWII, to stop overflying aircraft from having easy targets and to disrupt navigation). Reduced voltage on the grid -> lights go from white to orange and eventually to brown, not quite a blackout -> brown out.
I wonder what the effect of their helm charts will be. As far as I know the charts play well together with their own images but not necessarily with other images (like the official images). Also in some cases particular versions of helm charts are needed for particular versions of the application/images.
So then there are no tagged versions of the images. How will this affect the future of the charts? The old (existing) charts can easily point to the old images in the legacy repository. But how about future development? Will this be stopped, so the charts will remain in the existing state? Or will it be continued but point to the new "latest" images - which means the chart/image combination could break at any time?
Bitnami has a number of docker images that are returned by search results (https://hub.docker.com/r/bitnami/redis-sentinel was one that I came across a while ago), and even before this I was concerned about how their images keep getting returned by search results.
I thought I was paranoid, not wanting to have containers that rely on an organization that I didn't know much about (I didn't know that Bitnami was part of Broadcom/VMW), but this just proves my worries were well founded.
I use a few bitnami charts, and I'm now going to have to migrate them.
For everyone here surprised that anyone would use them, here's some context from my perspective: as a small startup, having a pre-configured Kafka chart was a lifesaver, where I only needed to tweak the parameters I was interested in, which took me a lot less time than setting up a whole Kafka environment from scratch. It was relatively quick to setup, and felt like the right move to put something like Kafka in production (and not have to pay for Confluent when everything else is self hosted)
Almost the same situation here. The only thing I used was Kafka, and I only used that to allow horizontal scaling of Argo Events sensors. Moved over to jetstream, saved a bunch of compute and memory, and realized I didn't need to scale Argo's sensors horizontally. Really, Bitnami's decision made my life easier in the end.
“If you’re looking to deploy multiple images, Chainguard’s per-image charges could quickly exceed Bitnami’s flat subscription cost. For example, licensing 3 images at $30K each would already reach $90K/year.” via Reddit.
There is a new Catalog option. Their pricing is “custom” and not published online so all we have is Reddit anecdotes like here
Updating the Bitnami images is probably a bit of a challenge. From looking at them last year, I believe that they are build around a Bitnami style/framework. They are confusing at best.
If you're Bitnami it probably made sense to do it the image the way they did, but for everyone else, it's just a massive complication.
Personally I don't understand why anyone would have opted to use the Bitnami images for most things. They are really large and complex images and in most cases you'd probably be better of building your own images instead.
My guess is that there's a very small overlap between people who want to maintain Docker images, and the people who chose to run Bitnamis images.
The Docker images are complex for the sake of the Helm charts, which sometimes need to pass down tons of parameters
These aren't just for your laptop, they're supposed to be able to run in prod
I'm still stuck with 3 bitnami charts that I keep updated by building from source, which includes also building the images, all on our private registry.
> Personally I don't understand why anyone would have opted to use the Bitnami images for most things.
At my previous company, we used it because of the low CVE counts. We needed to report the CVE count for every Docker image we used every month, so most of the images were from Bitnami.
There are many enterprise companies freeloading on Bitnami images, and I’m surprised it took Broadcom this long to make this change.
In brief you need to switch the registry from (iirc) docker.io/bitnami to docker.io/bitnamilegacy. Note that as of iirc tomorrow those images will no longer be updated. So the moment there is a high or critical cve you better have a plan to use a new image and likely helm chart or send broadcom cash. The old registry will continue to have a "latest" tag but this should not be used for production.
Just to be crystal clear about the open source part: the code for all container images will continue to be maintained, kept up to date, and publicly accessible on GitHub (https://github.com/bitnami/containers) under the Apache 2 license.
What Bitnami is discontinuing is the publishing of prebuilt images to public registries. However, the build code remains available, so users can still build the images themselves and push them to their own registries by running a couple of commands.
I understand the vision behind trying to monetize these images for enterprise use, and can get down with the idea of maintaining both a “less secure but free” and “more secure but paid” model. But it appears that Broadcom’s intent is to over time force everything on to their enterprise offerings, which seems like a short sighted thing to do.
Over time it will limit adoption and ultimately just make everyone go back to the native open source offering, cutting bitnami/Broadcom out of the loop.
Broadcom really took the open source community backwards with this move IMO.
Anyone know what happens to their Helm charts? As far as I know they remain available but do they work with non-Bitnami images? Can I use the official redis image instead of bitnami/redis with the Bitnami redis chart for example?
Q: What will happen to the existing OCI Helm charts?
A: The already packaged Helm charts will remain available at docker.io/bitnamicharts as OCI artifacts, but they will no longer receive updates. Deploying these charts will not work out-of-the-box unless you override the bundled images with valid ones.
*except for the BSI images included in the free community-tier subset.
That’s the first part, but will the charts work if I override the image name with a non-Bitnami one (e.g. docker.io/library/redis for redis)? Or do they bake in special stuff in their images that their charts rely on?
24 hours? Wouldn’t it be better to do shorter bouts of scheduled unavailability so unknowing people’s systems will boot up without manual intervention, but still generate lots of nasty logs / alerts?
I thought the opposite: 24h seems too brief to me, since many of their images are typically for long running servers, some people will receive a painful heads up only next year or later when their K8s pod gets scheduled to a new machine, requiring a (failing) pull.
I'm glad this was top of Hacker News because I hadn't heard about this until now, and we'd only have found out once deployments started failing.
It's not always a 5 minute job to switch to a different image with different configuration and retooling required.
Fortunately, I started moving us away from Bitnami a little while ago because they started giving me the ick some time back, but a few stragglers remain.
Maybe they're still counting back ports as CVEs? (Seems like scanning software still always false positives on a listening port that flags for a version and doesn't take into account backport and doesn't actually test for the CVE/vuln-- it's so exasperating weeding through reports thrown at you by "Security")
But yeah seems unlikely that official Debian images would be full of CVEs unless they are not being regularly updated.
> The Photon images provide many other benefits not previously available to users of Debian images, including:
Drastically reduced CVE count (e.g., 100+ CVEs to in some cases 0)
This implies that they are deliberately offering Debian images with known unfixed security vulnerabilities. Sounds evil.
I don't want to discount the work they are doing, and that it has no value, but a little bit shocking that they expect to go all commercial with this, in the Oracle way, while just "packaging" and so relying on open source software that they will not contribute to.
Also, I'm a little bit wondering at how much all of this is really copyrightable in the end. Because if you keep it private I understand, but here it is basically for each package just a few lines, recipes to build the components that they don't own. Like trying to copyright the line "make build".
And it might be each the single and obvious way to package the thing anyway.
And speaking at the built artefacts, usually a binary distribution of third party open source software with common license should preserve the same rights to the user to access the source code, the instructions to build, and the right to redistribute...
"Makefile" they have written and copyrighting is very non trivial and there are many man-months of effort. Configuring all sorts of software just with env vars and make it usable is not an easy feat.
Have a look at https://github.com/bitnami/containers/tree/main/bitnami/post... as example.
It might be worth a commercial license for some of their current user-base, no doubt.
Not everything that's authored and published is eligible for copyright. Copyright applies to only the creative elements of a work that are unique. Things that are facts, or are necessary for function are not copyrightable.
They likely hold a copyright on the exact expression of their documentation, but the facts and information in that documentation, and necessary configuration such as port numbers, and dependency selection are not subject to copyright.
Surely some of this complexity is self-inflicted, like an SSL cert renewal tool built with InstallBuilder: https://github.com/bitnami/bncert
This has to be a joke, right? Months of effort for a makefile? In which world do people live these days
12 replies →
What probably carries more value is the helm charts that they provide which are also on their way out.
The images themselves have official replacements (for example, looking at https://hub.docker.com/u/bitnami why wouldn’t I use Node or Postgres images from the official sources instead).
I have no idea how many people actually used their helm charts though.
They do keep some of them more up to date, for example the bitnami python image had system packages patched faster than the official one. But if you are willing to pay then chainguard is a better solution.
14 replies →
Some other open source projects have also shipped Bitnami software in their own helm charts, i.e. APISIX's etcd instance is the Bitnami chart pulled in as a dependency.
Not that it ever worked well, we had to scale it to 1 because the quorum would constantly break into unrecoverable states.
1 reply →
> However, in order to sustain and support the dedicated team of engineers who maintain and build new charts and images, a subscription will be required if an organization needs the images and charts built and hosted in an OCI registry for them.
This is such a naive take. Bitnami images were a sign of goodwill, a foot in the door at places were the hardened images were actually needed. They just couldn't compete with the better options on the market. This isn't a way to fix it, it's extortion. This is the same thing Terraform Cloud did, and I don't think that product is doing so hot.
> Essentially, Bitnami has been the Jenkins of the internet for many years, but this has become unsustainable.
It's other people's software, so it's very rich of Bitnami to accuse anyone of freeloading when their only contribution is adding config options to software that maybe corresponds to a level 2 on the OperatorFramework capability scale[1] - usually more of a 1.
[1]: https://operatorframework.io/operator-capabilities/
> It's other people's software, so it's very rich of Bitnami to accuse anyone of freeloading when their only contribution is adding config options to software
I'm not going to defend a corporation but this sentence feels very entitled. They were providing it for free, you could use it. They are not going to provide it for free anymore, you migrate to something else or self-maintain it and say "thank you for the base work you did I can use now"
Aye, It's a bit like saying you can't sell your code, because you wrote it in someone elses software.
Writing a decent Dockerfile isn't hard, and keeping it maintained and working with new versions is still work and it's past the wheelhouse of very many people. It's entirely reasonable to want paid for that effort.
That said, it's not work I personally value enough to put my hand in my pocket, and that's a fair take too.
When a project is abandoned, when updates are slow, when features people want are not being released, when tracking upstream dependency updates are delayed, sure, you are not entitled to anything and I’ll be the first one to say get off your butt and contribute. In the other hand when you engage with the community for years under an OSS/free context then once the community has invested in your project, learning it, creating learning resources for it, integrating it into their own projects, and you never communicated your intention to “wait until it gets big then then pull the rug” it feels like a disingenuous bait and switch. The reason it feels that way is because it is a disingenuous bait and switch. This is even more so the case when you built your project on top of other projects.
I have no problem using a paid product or service or paying for support on a OSS product, but will never pay one of these bait and switch scams a dime, no matter how much engineering effort it takes.
3 replies →
I think it's perfectly fair for them to say "we're not doing this any more". The sketchy part is deleting the public registry at docker.io/bitnami rather than just no longer updating it. Why can't docker.io/bitnami become the 'legacy' registry, receive no future updates, so at least folks who don't hear this news won't have pulls suddenly fail?
edit: like if I have a package on NPM and I want to stop offering it, I think it's shitty to just delete it. That breaks builds.
Vendor lock-in is a thing. Switching costs are a thing. They know this. That's the whole business model. They're expecting that the cost of switching to outweigh the cost of the subscription.
I get that this business model is fashionable amongst wannabe rent-seekers, but it's still antisocial and should be shunned.
11 replies →
> it's extortion
That's a wild take for "somebody provided something for free but decided they don't want to anymore".
Sucks for you, looks like you have to do your job yourself now.
Reminds me of a joke, where there was a beggar sitting on a street next to a certain office, and one man has been giving him a coin every time he went to work or was going home. That continued for a while, until one day the man says to the beggar - "you know, I've been giving you a coin twice a day for a while now, but now I am getting married, it's an expensive thing so I can't give as much anymore, I only will be giving you a coin once a day from now on". And the beggar cries out: "Look at this putz, he's getting married and now I have to feed his whole family!"
2 replies →
What do you mean, that's the business model more than half the VC-funded startups now. Provide something for free or near free, wait until your customer is dependent on you and/or consolidate into at least an oligopoly and then put the thumbscrews on.
I find that to be a pretty dishonest business model. I don't have any Bitnami images to replace, but I know a lot of people who do without ever having made that choice - and their bosses aren't going to pay Broadcom for the most part either. So you end up with overworked developers that now hate Broadcom and/or a whole lot of deployments that just break or never get updated. The number of people going "I can just switch over to the archive image, whatever" on the K8s subreddit alone is concerning.
2 replies →
>This is such a naive take. Bitnami images were a sign of goodwill, a foot in the door at places were the hardened images were actually needed. They just couldn't compete with the better options on the market. This isn't a way to fix it, it's extortion. This is the same thing Terraform Cloud did, and I don't think that product is doing so hot.
You seem to be confused about who Broadcom is and how they operate. "Long term health" isn't a thing for them. They buy products that are embedded deeply in the fortune 500, cut 90% of the staff, and increase licensing and support 2-100x. They do not care if you are upset. They do not care if you're going to "find something else". They don't care if you build an entire campaign to decry what they're doing.
They know the F500 cannot easily remove them, and that they will have at minimum 5 years to print cash on their service contracts. Sure, some of those F500s will sue them and try to stop the extortion via legal means, but they know that they'll either win, or at worst still be allowed to jack up prices even if a court rules it's not their original egregious asking price.
Building Infrastructure company is challenging in 2025. Previously, you would prioritize traction among developers over focusing on revenue.
But that does not work in 2025. You are expected to make money from the get-go and are left with only enterprise customers and boy, that category is hard, as everyone is competing for that slice.
> Previously, you would prioritize traction among developers over focusing on revenue.
A.k.a. using open source as a marketing tactic to lure in customers, only to do a rug pull once the business gains enough momentum.
> But that does not work in 2025.
Good. It is an insidious practice. There are very few projects that actually do this properly without turning their backs on the users who made their products popular in the first place.
> You are expected to make money from the get-go and are left with only enterprise customers and boy, that category is hard, as everyone is competing for that slice.
The strategy of delivering valuable products that benefit users without exploiting them has always existed. The thing is that many companies choose the greedy and user hostile path, instead of running a sustainable business that delivers value to humanity and not just to shareholders, which is much more difficult. So I have no sympathy towards these companies.
1 reply →
The problem I think is that all the easy infrastructure problems have been solved and the market is crowded with those solutions. Solving the hard problems is probably where you could have a viable business but I don't really see that many companies trying to solve those:
* Making mono-repos work for large companies.
* Mixed language builds are still a ci/cd unsolved problems for most companies.
* Testing strategies for Iac deployments.
And more that I won't bother to list here.
1 reply →
So, you're saying in 2025 businesses are expected to actually make money? What a novel concept. Will the wonders ever cease? I mean, you could expect that thing where you borrow incessantly to "gain traction" and "produce growth" but never produce any returns on it to run for a bit, especially in a new field where becoming #1 is at premium. But it has to stop somewhere. So it looks like somewhere is here.
The outcomes of this behavior will be devastating and the problems will last for generations.
4 replies →
I have an infrastructure company and I'm focused 100% on developers. It definitely isn't easy, but I see it as the best path for the business.
You're not wrong. They add miniscule value. But what does that say about the people using these images who are now struggling to replace them?
You can't have it both ways.
If their value-add was miniscule then they should be trivial to replace.
If it's a struggle to replace them then that's the value they were adding.
4 replies →
Packaging is not miniscule value, it's valuable gruntwork.
4 replies →
it doesn't say anything nice that "moderate inconvenience" is a "struggle"
I think this is now the Broadcom way !
If their contribution is minimal then the impact of this change should also be? But it appears it disruptive so they have been showing up for a long time and that’s one of the most difficult things.
Maybe the community can repackage it since Bitnami is only packaging.
Naive take.
That's like saying, "Honda isn't a car company, they're an assembly company because they don't mine the minerals to make the parts and rely instead on supply chains"
3 replies →
In the end, they have to do it because of the CSR, and they can do it because of the CSR.
The European Union Cyber Residence Act has the potential to drastically change the open source ecosystem.
The new regulation pushes the due diligence for security according to the Act towards any entity making a commercial offer based on open source software.
Caveat emptor!
For any enterprise, that means that they either do extensive documentation and security on open source components they use or they use foundation or enterprise-backed products.
Note that pure uncommercial open source projects are exempt from the Act.
I see this as a chance; we can still create open and free software, and those of us who desire financial compensation from those who make money with their work can offer as a necessary compliance framework as a service via a different entity.
I don't agree, they have to do all the CSR due diligence for the commercial offerings based on those open source projects, so there is no difference. The effort has to be done regardless if there's part of it that is open source and free, or not.
They don't have to. They can do the paid secure images for the commercial offerings and keep the other ones free. Or they could free the secure images for everyone if they feel like that.
Hmmmm, I'm not sure that's how it would be read. If there's any 'associated commercial activity', it falls under the CSR, even if the images themselves are free and open source.
(That said, the overhead of the CSR is really not much, from what I can tell. It's pretty lightweight as EU standards go)
If you’re looking for an alternative here, we (the team that built Twistlock) launched Minimus a few months ago to provide near zero CVE images built continuously from source. We have long experience in this space (we even wrote NIST SP 800-190) and I’d love to talk if we could help anyone. We also have drop in replacement images and charts for Bitnami, as we describe here: https://www.minimus.io/post/the-bitnami-pricing-changes-what...
If anyone has tech questions about how it all works, tools we use, customer scenarios, etc I’d be happy to discuss.
Also, this form is nonsensical https://www.minimus.io/get-started#signup-form because it distinguishes between "Individual" and "Organization" but then Company is a mandatory field. Maybe just go ahead and label it "Lead Gen / Ask For A Demo"
Not that anyone cares, but I can confirm this is the case: the response is an email from some marketing person asking to "have a call" and then a few days later my email gets some random spam from being subscribed to every mailing list they own. What a farce
Let me rewrite the comparison used in the "Example: Using Bitnami vs. Minimus" section of the blog post:
Using Bitnami Secure Images: You pull a versioned PostgreSQL image built on a minimal-attack-surface OS (Photon). When a CVE is disclosed or a new upstream version is released, Bitnami’s automation takes care of everything: a new container image (and Helm chart, if applicable) is built, tested, and published to your registry within hours. All you need to do is update to the latest version; no manual CVE monitoring, triage, or patching required.
The main question as always is price. I was also interested in things like Chainguard and Docker secure images until I had a sales call with them and found out the price.
I can’t seem to find the price anywhere on your site… I assume the reason for that is that it’s also nearly impossible for a non-fortune 500 to afford?
Nope - we're early stage so we're really flexible not just on pricing but licensing terms too. We have many customers that are smaller startups, not just typical F500 types.
Is Minimus OS? Bitnami continues as OS project and anyone can build the images from source.
Please offer an implementation of the docker-credential helper, just like chainguard does with docker-credential-cgr[1], and don't put throwaway text that says "docker supports credential stores, so good luck to you" on your website https://docs.minimus.io/foundations/authentication#using-a-c...
1: https://edu.chainguard.dev/chainguard/chainguard-images/chai...
It's on the roadmap :)
It's a good feature, just hasn't been prioritized so far because customers haven't really had trouble with the current basic approach.
Snooping around, it seems the license costs $50K+ annually. I'm not their target market. ;)
From TFA
> BSI is effectively democratizing security and compliance for open source so that it doesn’t require million-dollar contracts from vendors with sky-high valuations.
I suppose 50k isn't a million dollar contract, but it's certainly also not "democratizing" anything
Depending on your needs, this could be a bargain as advertised. It's only expensive relative to what you can build on your own, or what competitors offer.
It's a bit tricky to work through all the jargon, but it's my understanding that they are simply pulling the mass of things that they provide for free. You can still get the Docker files for their offerings (not sure they offer all tags though?") and you can even use the images from Docker Hub.
But. What they are offering is considered "development" regardless of what you are using it for? In other words, NOT a production environment, because they aren't giving you a production environment (or at least what they define as a production environment.) What they give you for free is the "latest" and on a Debian system.
What they offer as "secure" is running on Photon OS and goes through a security pipeline, etc. They aren't holding anything back aside from the services they provide.
The easiest strategy to be profitable as biz without acquiring new users base, lol :P
Between the VMware licensing changes and this, it looks like Broadcom is making a serious play at dethroning Oracle as the most evil software vendor.
It's a shame that competition for this position has been ramping up lately.
I'm still waiting to see how Broadcom will monetize the Spring ecosystem - which is widely used in almost all large enterprises.
Sadly, it feels like an inevitability at this point.
Good lord, I didn't know their tentacles were that deep. VMware sure had a lot of touch points.
My team is worried about that too. We've been a java and spring shop for years. We're looking at micronaut, it's similar enough.
When I had someone from another team take a look at broadcom and what they could do to spring, they said the licenses are permissive, it will be fine. Likely not that simple.
1 reply →
Holy shit, Broadcom owns Spring? Yikes.
That's probability of 1.0, the missing question is when.
Yes, same here. Wonder how they will try to monetize it.
This is much less exciting once you realize how evil broadcom is. Still, I suppose we all win in the short term.
They're still technically Avago Technologies, just wearing the name of Broadcom after the acquisition in 2015-2016. Not sure if there's much of Broadcom left, beyond the name and what IP they had at the time which was not sold off, like they did with the IoT related IPs.
I am certain most of Bitnami's engineers don't agree with those decisions.
Taking a bunch of projects and making containers and flexible helm charts for them is kind of an interesting model. It’s what Redhat and Canonical do with raw Linux packages; they charge for premium support and even patches or extended support.
I was going through one of my clusters, I have two bitnami uses and they are both ‘building blocks’ I use Trino, which uses a metastore which uses postgresql and then some other package uses redis. It seems like both postgresql and redis could/would have containers and charts to install their stuff, where it breaks is the postgresql guys probably want to support “current” and not 4 major releases back, which is kind of normal to see in the wild.
It is kind of an interesting model, I’d love it if rancher or openshift or someone started to seriously compete. Shipping a Kubernetes in a box is nice but if they started packaging up the building blocks, that’s huge too.
1 reply →
I won't be so sure about that. Bitnami's installer was always proprietary software.
Microsoft's existence means they're all fighting for 2nd place.
Broadcom has always been about pure evil (cough capitalism cough), you just haven't been affected by it before. Ask anyone who's worked with their hardware... So
So, are they evil because they decided to stop sponsoring free network egress?
Others have already provided good answers. I wouldn't classify it as evil if all they did was to stop maintaining the images & charts, I recognise how much time, effort and money that takes. Companies and open source developers alike are free to say "We can no longer work on this".
The evil part is in outright breaking people's systems, in violation of the implicit agreement established by having something be public in the first place.
I know Broadcom inherited Bitnami as part of an acquisition and legally have no obligation to do anything, but ethically (which is why they are evil, not necessarily criminal) they absolutely have a duty to minimise the damage, which is 100% within their power & budget as others have pointed out.
And this is before you even consider all the work unpaid contributors have put into Bitnami over the years (myself included).
13 replies →
The images are currently in Docker Hub. If $9/month (or $15, not 100% sure if $9 includes organizations) to keep those images available is too much for Bitnami I'm sure there are many organizations who wouldn't mind paying that bill for them (possibly even Docker Hub itself).
Broadcom is deciding to host it on their own registry and bear the associated cost of doing so. Not sure what this has to do with sponsoring network egress
Does said network egress cost $50k per user?
I advocated an enterprise to migrate away almost two years ago now. In enterprise time that means the project to do so is just about complete, so I am feeling pretty vindicated just now.
I was never a fan of images from Bitnami. They always used complicated entrypoint and setup scripts, and introduced weird quirks to the software. More than once have I experienced issues or ran into configuration limitations with Bitnami images that didn't exist in official ones.
So good riddance, as far as I'm concerned. I recommend anyone to avoid using them, and switch to official images or to build them yourself if they're not provided. That's the more secure approach, anyway.
I concur. There was supposedly a migration path from their postgresql image & chart to the postgresql-ha image & chart.
Aside of having to re-mount the data disk and move things around manually; the -ha chart has numerous other issues where it always requires the master to be node-0. And with pods being rescheduled within a statefulset, good look having the master be on node-0. If there was an outage and the master is anywhere else, node-0 will just 'wait' for a master to come online, time out and shoot itself in the head thinking it is in a network partition and that retrying may help.
The algorithm implemented by postgresql-ha turned out to be plain broken. Only able to survive pods neatly shutting down.
Sometimes, over engineered approaches are necessary to make older software work with environment variables and configmaps, because said software is still designed for traditional VM deployments.
Agreed, Bitnami images often feel over-engineered.
Understandable.
The way I see it, a software project has only (1) code you maintain or pay someone to maintain for you, and/or (2) throwaway code that you will eventually need to replace with an incompatible version.
Nothing wrong with a project that is just gluing throwaway code because it's a gamble that usually pays off. But if that code is from third-party dependencies, just don't believe for a second that those dependencies (or any compatible forks) will outlive your project, or that their developers have any incentive at all to help you maintain your project alive.
It is sad to see how Broadcom cannot do padding right for mobile…
But on topic: why not create docker.io/bsi and let /bitnami as is without new updates? Then nothing breaks; it just won’t be possible to do upgrades. You’ll then figure out why and possibly seamlessly switch to your own build or BSI.
> But on topic: why not create docker.io/bsi and let /bitnami as is without new updates?
If people are relying on you for automatic security updates, and you've decided to no longer provide these updates [for free], users should opt in to accept the risk.
This would normally require user action (after a period of warnings/information), and having the fix look 'obviously' unsafe (`/bitnami ` ->`/bitnamilegacy`) feels reasonable.
Because "bitnami" has brand value. It makes business sense to reuse the name for the new service you are trying to sell.
Any brand value that bitnami has will be entirely destroyed by this incomprehensible change. People will associate the ‘bitnami’ namespace with “can’t possible utilize for long term production use”
> It is sad to see how Broadcom cannot do padding right for mobile…
It's on brand when you consider how badly the styling in Rally needs an update.
I never understood the point of Bitnami. Every time I tried one of their image / package, it's a complicated mess full of custom and strange stuff, really hard to work with.
Instead of a simple package of the software based on some familiar base, you get some weird enterprise garbage that follows strange conventions and a nightmare when you need to customize anything.
100% agreed. I don’t understand the point of throwing all conventions out the window and building their own brittle scripts on top of it. All their images require docs to configure because none of the upstream documentation applies.
I've used them as a quick way to get rootless configured base images. Not sure if official repos provide those now, but it used to be a big hassle to get things like postgres images running without root in their containers. Although I often had to read through their dockerfiles to figure out the uid setup, where configs live, etc because they were not consistent between the various bitnami images.
Back in the day, Bitnami was a way to run Wordpress on Windows. They packaged it nicely so that you could install it on Windows Server. Nowdays that could get you fired, but back then Linux was not so widespread.
What are some resources for these conventions? As far as I can tell everyone else rolls their own bespoke images based off of of a projects image in order to customize the configuration.
At my last gig I avoided Bitnami container images and Helm charts wherever possible. We (me plus an AWS consultant) used Karpenter Autoscaler, Envoy Gateway API, Gatekeeper OPA, Loki/Prometheus/Grafana Stack, EDB Postgres Operator, ... and deployed all through a single comprehensive terraform script to an EKS cluster. I tried to keep reliance on one single company as low ad possible. I even had a Plan B to replace S3 with MinIO in case the company decided to move to another cloud provider or an On Prem Kubernetes cluster.
My recommendation to everyone is to avoid Cloud Vendor Lock-In from the start, and even if it's more initial work, to try to have as much as possible running on Kubernetes.
Good to see they decided to delay a bit and do some brownouts first. I took a quick look at the Docker hub stats (https://raesene.github.io/blog/2025/08/21/bitnami-deprecatio...) and it looks like some of those images are still getting hundreds of thousands or even millions of pulls a week.
The list of images for the first brownout: external-dns, Kafka, Memcached, WordPress, Grafana, Cassandra, Prometheus, OpenLDAP, Thanos, Python.
Thanks for mentioning these! Do you know what are the official channels they're doing the announcements in? In the post they just mention the word "usual" with no clarification.
1 reply →
Meanwhile if anyone wants images with dramatically higher supply chain security than anything Bitnami ever offered, and free to the public forever, check out stagex.
https://stagex.tools
As the only multisigned, full source bootstrapped, reproducible, and container native distro that exists, it does not matter what registry you pull from because the digest is the same everywhere.
We publish all images to both dockerhub and quay and signature checks pass either way so mirror anywhere you want.
Anyone claiming they need to host in a particular registry for security is gaslighting you.
I believe Guix also borrowed[1,2] the bootstrap chain[3,4,5] written by Jeremiah Orians, same as you did.
[1] https://guix.gnu.org/en/blog/2023/the-full-source-bootstrap-...
[2] https://www.gnu.org/software/mes/
[3] https://bootstrapping.miraheze.org/wiki/Stage0
[4] https://savannah.nongnu.org/projects/stage0/
[5] https://github.com/oriansj/bootstrap-seeds
They absolutely did, and beat us to it. They were a fantastic reference, and we link to their blog posts in our readme. We even have a comparison with Guix there too.
https://codeberg.org/stagex/stagex/#comparison
Guix optimized for maximizing package and architecture variety quickly and focused on retrofitting supply chain security tactics as a secondary goal later where possible. For example it allows for untrusted packages with binary blobs in the supply chain in cases like Haskell, Ada, and Qemu. Their supply chain security efforts are on a package by package basis and not mandatory, and still assume that all maintainers are unable to be compromised.
Stagex by contrast is a supply-chain-security-first distro that can trust no single maintainer or computer by design. As such, Haskell and Ada are impossible to add support for right now as no bootstrap path exists for them.
With Qemu we did the hard work of learning how to build all those binary blobs ourselves from source because we really needed it.
Guix has by far the best supply chain security of any workstation distro out there, but I would never ever use it in the supply chain of anything bound for high value production use where no single person should be trusted. Guix is also very difficult to use in container environments as it has no signed/reproducible OCI images so you would have to build all that yourself.
That is what stagex was built for.
Is "brownout" a common or standard term in the industry? First time I see it.
Commonly used in microcontrollers to describe supply voltage dropping below threshold. It could cause RAM corruption, erratic behaviors of robots, overshoot in voltage regulators, battery fluid leaks etc., and so optional detection features are often made available to reset or stop the processor and notify the application on next boot.
It's also used in utility power supplies to describe line voltage going below spec. It's considered a dangerous condition in that context too, as lots of non-smart equipment tend to run at higher amperage at lower voltage and/or fail to start/run and catch fire.
1: https://developerhelp.microchip.com/xwiki/bin/view/products/...
We did this at stripe when deprecating TLS 1.0, and called it a brown out (I don't know the origin of the term in software).
You do it when you have a bunch of automated integrations with you and you have to break them. The lights arent on at the client: their dev teams are focused on other things, so you have to wake them up to a change that's happening (either by causing their alerting to go off, or their customers to complain because their site is broken)
have also heard this as doing a “scream test” — turn it off, see who screams about it
Yes, another example of brownout at https://spring.io/blog/2022/12/14/notice-of-permissions-chan... It is probably the only way to warn users when you do not know the contact info.
Yes I heard of GitHub doing it I think
You intentionally break something just a little to force dependents to notice, before turning it off completely
There was actually a really terrible brown-out by Poetry (a Python dependency management and packaging tool) where they introduced sporadic failures to people's CI/CD systems: https://github.com/python-poetry/poetry/pull/6297
First heard about this when docker started rate limiting
Yes.
It refers to a situation where a system is deliberately designed to fail (usually for short periods of time), to still provide some level of service while alerting others that the system is soon to be turned off.
Yes. Going from green to red is called “browning out”.
That is not where the term comes from. Lights out -> Blackout (WWII, to stop overflying aircraft from having easy targets and to disrupt navigation). Reduced voltage on the grid -> lights go from white to orange and eventually to brown, not quite a blackout -> brown out.
1 reply →
Is that the origin?
I thought it was an analogy to the electrical problem: flickering lights due to high demand.
3 replies →
I wonder what the effect of their helm charts will be. As far as I know the charts play well together with their own images but not necessarily with other images (like the official images). Also in some cases particular versions of helm charts are needed for particular versions of the application/images.
So then there are no tagged versions of the images. How will this affect the future of the charts? The old (existing) charts can easily point to the old images in the legacy repository. But how about future development? Will this be stopped, so the charts will remain in the existing state? Or will it be continued but point to the new "latest" images - which means the chart/image combination could break at any time?
Website got hugged to death: https://archive.is/plsp9
Bitnami has a number of docker images that are returned by search results (https://hub.docker.com/r/bitnami/redis-sentinel was one that I came across a while ago), and even before this I was concerned about how their images keep getting returned by search results.
I thought I was paranoid, not wanting to have containers that rely on an organization that I didn't know much about (I didn't know that Bitnami was part of Broadcom/VMW), but this just proves my worries were well founded.
I use a few bitnami charts, and I'm now going to have to migrate them. For everyone here surprised that anyone would use them, here's some context from my perspective: as a small startup, having a pre-configured Kafka chart was a lifesaver, where I only needed to tweak the parameters I was interested in, which took me a lot less time than setting up a whole Kafka environment from scratch. It was relatively quick to setup, and felt like the right move to put something like Kafka in production (and not have to pay for Confluent when everything else is self hosted)
Almost the same situation here. The only thing I used was Kafka, and I only used that to allow horizontal scaling of Argo Events sensors. Moved over to jetstream, saved a bunch of compute and memory, and realized I didn't need to scale Argo's sensors horizontally. Really, Bitnami's decision made my life easier in the end.
Is anybody familiar with the differences between the new Bitnami Secure Images compared to images from, say, Chainguard?
IronBank is free though more DoD focused
“If you’re looking to deploy multiple images, Chainguard’s per-image charges could quickly exceed Bitnami’s flat subscription cost. For example, licensing 3 images at $30K each would already reach $90K/year.” via Reddit.
There is a new Catalog option. Their pricing is “custom” and not published online so all we have is Reddit anecdotes like here
https://www.reddit.com/r/cybersecurity/comments/1ihy9sr/chai...
Is anyone working on mirroring the images and keeping them updated?
Updating the Bitnami images is probably a bit of a challenge. From looking at them last year, I believe that they are build around a Bitnami style/framework. They are confusing at best.
If you're Bitnami it probably made sense to do it the image the way they did, but for everyone else, it's just a massive complication.
Personally I don't understand why anyone would have opted to use the Bitnami images for most things. They are really large and complex images and in most cases you'd probably be better of building your own images instead.
My guess is that there's a very small overlap between people who want to maintain Docker images, and the people who chose to run Bitnamis images.
The Docker images are complex for the sake of the Helm charts, which sometimes need to pass down tons of parameters
These aren't just for your laptop, they're supposed to be able to run in prod
I'm still stuck with 3 bitnami charts that I keep updated by building from source, which includes also building the images, all on our private registry.
3 replies →
> Personally I don't understand why anyone would have opted to use the Bitnami images for most things.
At my previous company, we used it because of the low CVE counts. We needed to report the CVE count for every Docker image we used every month, so most of the images were from Bitnami.
There are many enterprise companies freeloading on Bitnami images, and I’m surprised it took Broadcom this long to make this change.
That only works for weeks or so, since they won't be updated, according to the PR.
It's time to build your own from core / foundational images - something I recently learned and now seek to master.
Would you kindly share how to do it?
5 replies →
In brief you need to switch the registry from (iirc) docker.io/bitnami to docker.io/bitnamilegacy. Note that as of iirc tomorrow those images will no longer be updated. So the moment there is a high or critical cve you better have a plan to use a new image and likely helm chart or send broadcom cash. The old registry will continue to have a "latest" tag but this should not be used for production.
According to the article the current situation already is a bit of a clusterfuck:
The Photon images provide many other benefits not previously available to users of Debian images, including:
1 reply →
RapidFort has bitnami compatible images community (free) and curated images - www.hub.rapidfort.com
Just to be crystal clear about the open source part: the code for all container images will continue to be maintained, kept up to date, and publicly accessible on GitHub (https://github.com/bitnami/containers) under the Apache 2 license.
What Bitnami is discontinuing is the publishing of prebuilt images to public registries. However, the build code remains available, so users can still build the images themselves and push them to their own registries by running a couple of commands.
I understand the vision behind trying to monetize these images for enterprise use, and can get down with the idea of maintaining both a “less secure but free” and “more secure but paid” model. But it appears that Broadcom’s intent is to over time force everything on to their enterprise offerings, which seems like a short sighted thing to do.
Over time it will limit adoption and ultimately just make everyone go back to the native open source offering, cutting bitnami/Broadcom out of the loop.
Broadcom really took the open source community backwards with this move IMO.
To continue Bitnami within the community, I just created bitmoa yesterday.
The goal is to replace bitnami image with minimal changes (e.g. ENV Names).
https://github.com/bitmoa/containers https://github.com/bitmoa/charts
I visited Bitnami in San Francisco in 2017, still have a hoody.
Broadcom is a rat.
Thank you thanos-io: https://github.com/thanos-io/thanos/issues/8381#issuecomment...
Anyone know what happens to their Helm charts? As far as I know they remain available but do they work with non-Bitnami images? Can I use the official redis image instead of bitnami/redis with the Bitnami redis chart for example?
This is covered in the official GitHub issue: https://github.com/bitnami/charts/issues/35164
Q: What will happen to the existing OCI Helm charts? A: The already packaged Helm charts will remain available at docker.io/bitnamicharts as OCI artifacts, but they will no longer receive updates. Deploying these charts will not work out-of-the-box unless you override the bundled images with valid ones. *except for the BSI images included in the free community-tier subset.
That’s the first part, but will the charts work if I override the image name with a non-Bitnami one (e.g. docker.io/library/redis for redis)? Or do they bake in special stuff in their images that their charts rely on?
2 replies →
24 hours? Wouldn’t it be better to do shorter bouts of scheduled unavailability so unknowing people’s systems will boot up without manual intervention, but still generate lots of nasty logs / alerts?
I thought the opposite: 24h seems too brief to me, since many of their images are typically for long running servers, some people will receive a painful heads up only next year or later when their K8s pod gets scheduled to a new machine, requiring a (failing) pull.
I'm glad this was top of Hacker News because I hadn't heard about this until now, and we'd only have found out once deployments started failing.
It's not always a 5 minute job to switch to a different image with different configuration and retooling required.
Fortunately, I started moving us away from Bitnami a little while ago because they started giving me the ick some time back, but a few stragglers remain.
If I had to hazard a guess, it's so the downtime is noticed across various different timezones.
Bitnami K8s helm charts was very well done but overall we can live without them.
I would suggest boradcom to offer two tie: one free on they repository and one se t of more specific images.
Burning the docker.io images is a dumb move.
I long advocated for a proper mirror and archive of the docker hub.
Will any source to build new images remain available without subscription?
They write in the press release, that the sources remain under Apache 2 license, they just stop distributing prebuilt images for free.
Edit: As I see it's true.
Source code for OCI images: https://github.com/bitnami/containers/tree/main/bitnami
Charts: https://github.com/bitnami/charts/tree/main/bitnami
> Source code for OCI images: https://github.com/bitnami/containers/tree/main/bitnami
If you look at the folders there, you'll see that all of the older Dockerfiles have been removed, even for versions of software that are not EOL.
For example:
PostgreSQL 13 (gone): https://github.com/bitnami/containers/tree/main/bitnami/post...
PostgreSQL 14 (gone): https://github.com/bitnami/containers/tree/main/bitnami/post...
PostgreSQL 15 (gone): https://github.com/bitnami/containers/tree/main/bitnami/post...
PostgreSQL 16 (gone): https://github.com/bitnami/containers/tree/main/bitnami/post...
PostgreSQL 17 (present): https://github.com/bitnami/containers/tree/main/bitnami/post...
> The source code for containers and Helm charts remains available on GitHub under the Apache 2.0 license.
Ofc they're all still in the Git history: https://github.com/bitnami/containers/commit/7651d48119a1f3f... but they must have a very interesting interpretation of what available means then.
It looks like setting up a mirror and CI/CD on top of Github might work for some time. ghcr is free for public images
3 replies →
Is it clear whether the Debian image sources will continue to be maintained?
2 replies →
This is such a weird state.
> The Photon images provide many other benefits not previously available to users of Debian images, including:
> Drastically reduced CVE count (e.g., 100+ CVEs to in some cases 0)
How can Debian image contain 100+ CVEs? It's nonsense. Surely Debian is as secure as most other "commercial" distros.
This CVE scanning stuff is clear FUD to promote commercial distros.
Maybe they're still counting back ports as CVEs? (Seems like scanning software still always false positives on a listening port that flags for a version and doesn't take into account backport and doesn't actually test for the CVE/vuln-- it's so exasperating weeding through reports thrown at you by "Security")
But yeah seems unlikely that official Debian images would be full of CVEs unless they are not being regularly updated.
A shame that the docker.io registry is not immutable and allows deletion. I think many people are unaware images from that registry can break anytime.
I'll be very curious to see if public.ecr drops theirs, too e.g. https://gallery.ecr.aws/bitnami/redis -> public.ecr.aws/bitnami/redis:8.2.1
This is great new for me. I've always disliked bitnami's busy file layouts and other weird preferences.
Bitnami has changed. It used to just be an easy way for me to get a fully configured wordpress installable exe.
Yes, that was worth it. But, other images apart from WP are ...
Anyone using their PHP images? Have you switched to FPM or started to build the bitnami images from source?
> Anyone using their PHP images?
With FrankenPHP, I can't imagine why I'd choose Bitnami anymore.
What timing…
This implies that they are deliberately offering Debian images with known unfixed security vulnerabilities. Sounds evil.
What are you talking about? Their images have _fewer_ CVEs.
Aren't these Debian images equally "their", but available for free? Aren't the free images what Bitnami is discontinuing?
Hack Tagalog
[dead]
[dead]