Bitnami’s August 28th Bombshell: The End of Free Container Images as We Know Them

On August 28, 2025, Bitnami is flipping the switch on its container image distribution model, effectively ending free access to production-grade container images that power millions of Kubernetes clusters worldwide. If you’re running Postgres, Redis, Kafka, RabbitMQ, NGINX, or any of Bitnami’s 280+ application catalog, this seismic shift demands your immediate attention.

For Draftt.io customers, you’re a step ahead, our platform flagged affected resources a month ago and provided tailored mitigation plans to ease this transition.

Here’s why this change is a game-changer for the cloud-native ecosystem and what you need to do now.

The Nuclear Option: What’s Actually Happening

Bitnami is pulling a “freemium to premium” move, reshaping its entire catalog:

What’s Disappearing (Free Tier):

• All versioned container images (anything not tagged “latest”)
• Most of the 280+ application catalog
• Regular security updates for free users
• Production-ready container images without a subscription
• Debian-based community images (replaced with Photon Linux or distroless bases)

What’s Left for Free:

• A small subset of “development-only” images
• Only “latest” tags (no version pinning)
• Limited application catalog
• No production support or guarantees

What’s Paywalled:

• Bitnami Secure Images (BSI): Full version history, hardened distroless bases, SBOMs, KEV transparency, attestations, and enterprise support for a price starting at $72,000 per year ($6,000/month) based on some reports on Reddit.

Exceptions:

• Sealed Secrets and minideb continue as usual under docker.io/bitnami.

The Bitnami charts repo, with ~10,000 stars and forks, is embedded in CI/CD pipelines, Helm charts, and clusters everywhere. This isn’t a niche issue. It’s a supply chain event.

The True Cost: Beyond the Price Tag

Immediate Financial Impact

The reported $72,000/year subscription for Bitnami Secure Images could translate to six-figure cost increases for organizations running hundreds of workloads across multiple clusters. For many, this is a budget shock for infrastructure that was previously free.

The Upgrade Treadmill Trap

Bitnami’s model forces a brutal choice:

1. Pay for BSI: Shell out $72,000/year for what used to be free.
2. Use “latest” tags: Abandon version control, risking deployment chaos, compatibility issues and compliance violations.

Version pinning is non-negotiable for reproducible deployments, rollbacks, and compliance. Both options break modern DevOps practices.

Dependency Hell Multiplied

Bitnami images underpin countless Helm charts, CI/CD pipelines, and automated systems. This change triggers cascading failures:

• Helm Charts Breaking: Charts expecting specific image versions will fail.
• CI/CD Pipeline Failures: Missing image references will halt automation.
• Security Scanning Disruption: Tools relying on consistent tags will break.
• Compliance Violations: Audits requiring specific versions are now at risk.

Silent Breakage Risk

Post-August 28, clusters pulling docker.io/bitnami/<app>:<version> may hit ErrImagePull or ImagePullBackOff if the image has moved to the unmaintained bitnamilegacy/ repository.

The Migration Nightmare: Three Bad Options

Bitnami offers three paths, none ideal:

Option 1: Legacy Repository Limbo

• Repoint to bitnamilegacy/<image>.
• Pros: Buys time.
• Cons: No security updates, no support, compliance risks, and a temporary fix.

Option 2: Pay the Broadcom Enterprise Tax

• Subscribe to Bitnami Secure Images for $72,000/year.
• Pros: Hardened images, regular updates, full version catalog, enterprise support.
• Cons: High cost for what was once free.

Option 3: “Latest” Tag Russian Roulette

• Use free “latest” tags from the limited community catalog.
• Pros: Free, minimal setup.
• Cons: No version control, unpredictable updates, impossible rollbacks, unsuitable for production.

Industry-Wide Implications

This isn’t just about Bitnami. it’s a warning for the cloud-native ecosystem:

• Precedent Problem: If Bitnami’s paywall succeeds, expect Docker Hub, Quay, or others to follow.
• Supply Chain Vulnerability: Over-reliance on free third-party images exposes systemic risks.
• Open Source Impact: Projects dependent on Bitnami images face tough distribution choices.

Action Items: What You Need to Do RIGHT NOW

If you’re a Draftt.io customer, you’re ahead of the curve. We flagged all affected Bitnami resources in your infrastructure a month ago and provided mitigation plans to streamline your response. Not a customer? Here’s how to catch up:

Phase 1: Immediate Assessment (Complete by August 1st)

1. Audit Your Image Dependencies

# Cluster inventory

kubectl get pods -A -o jsonpath='{range .items[*]}{.metadata.namespace}{"\t"}{.metadata.name}{"\t"}{range .spec.initContainers[*]}{.image}{"\n"}{end}{range .spec.containers[*]}{.image}{"\n"}{end}' | grep -E '(^|/)bitnami/'

# Helm releases

helm ls -A -o json | jq -r '.[] | [.name,.namespace] | @tsv' | while IFS=$'\t' read -r rel ns; do echo "=== $ns/$rel ==="; helm get values "$rel" -n "$ns" | grep -nE '(^\s*image:|repository:).*bitnami'; done

# Git repos

git grep -nE 'image:.*(docker\.io/)?bitnami/'

Identify Critical Workloads

• List applications using Bitnami images.
• Classify by business impact (critical/high/medium/low).
• Document version pins and update needs.

Calculate Financial Impact

• Count Bitnami image dependencies.
• Estimate BSI costs ($72,000/year).
• Compare against alternative solutions.

Phase 2: Strategic Decision Making (Complete by August 15th)

Evaluate Alternatives

Popular Apps (PostgreSQL, Redis, MySQL):

• Official Images: postgres:15, redis:7-alpine, mysql:8
• Cloud Provider Images: AWS RDS, Azure Cache
• Alternative Vendors: Crunchy Data, Redis Enterprise

Complex Apps (Kafka, Elasticsearch):

• Operator-based: Strimzi, ECK
• Cloud Managed: Amazon MSK, Elastic Cloud
• Enterprise: DataStax, Confluent

Dev Tools:

• Official Docker images
• GitLab/GitHub Container Registry

Build Migration Strategy

• Create an image migration matrix.
• Identify apps requiring BSI.
• Plan testing for alternative images.
• Document configuration changes.

Phase 3: Implementation (Start Immediately)

1. Gradual Migration

# Before: image: bitnami/postgresql:15.3.0

# After: image: postgres:15.3-alpine

1. Update CI/CD Pipelines

• Modify build scripts for new images.
• Update manifests and test deployments.
• Revise documentation and runbooks.

2. Security and Compliance

• Update scanning tools for new images.
• Verify compliance with new images.
• Monitor for vulnerabilities.

Phase 4: Risk Mitigation

Image Registry Strategy

• Set up a private registry (Harbor, AWS ECR, Google Artifact Registry).
• Mirror critical images to avoid external dependencies.
• Implement image promotion workflows.

Monitoring and Alerting

• Monitor image pull success rates.
• Alert on ErrImagePull or ImagePullBackOff.
• Track vulnerabilities and deployment success.

Alternative Solutions: Your Escape Routes

For Small to Medium Organizations

Option A: Official Images + Cloud Services Hybrid

• Use official Docker images and managed cloud services.
• Cache images in a private registry.
• Cost: Moderate, predictable.

Option B: Alternative Container Providers

• Chainguard Images, Google Distroless, Red Hat UBI.
• Cost: Varies, often cheaper than BSI.

For Enterprise Organizations

Option C: Container Platform Strategy

• Private registry with governance.
• Cost: High upfront, better long-term control.

Option D: Multi-Cloud Strategy

• Distribute workloads across cloud providers.
• Use managed services to reduce third-party dependency.
• Cost: Increased complexity, better diversification.

Conclusion: Act Fast, Plan Smart

Bitnami’s August 28th deadline is non-negotiable, and unprepared organizations face security risks, operational toil, or steep costs. Draftt.io customers got a head start with early alerts and mitigation plans, but everyone needs to act now. The silver lining? This disruption forces stronger, vendor-independent infrastructure. Teams that tackle this head-on will build more resilient systems.

The clock is ticking. August 28th is coming.

Need Help?

Are you facing this challenge? We’ve helped teams navigate complex cloud-native transitions and can assist with:

• Infrastructure dependency auditing. Understand your current state and existing risks.
• Migration, upgrade and risk mitigation planning
• Automating End-of-Life Identification, Prioritization and Mitigation

Don’t wait until August 27th.

Book a call using this link: https://calendly.com/draftt/intro

Let’s turn this crisis into an opportunity for better systems.