Something changed in December 2025 that most one-server operators missed. Docker released its full catalogue of over 1,000 hardened Debian and Alpine images under the Apache 2.0 licence, with no pull metering and no restrictions on how you use them, according to Docker’s own announcement. Its documentation now lists Community as a permanent free tier sitting below Select and Enterprise.
So the money question has settled, and two better ones have taken its place. What do you get before anyone asks for a card? And what does leaving cost you later?
Docker, Chainguard and Minimus each mean something different by free, and the migration between them is shorter than its reputation.
Three Definitions Of Free
These free tiers rest on completely different assumptions about how you’ll use them, which is why comparing them on price gets you nowhere.
Chainguard’s Catalog Starter went live on 17 March 2026 and gives you five images of your choosing from across its base, application and AI tiers, with unlimited pulls. The constraints are worth knowing before you sign up, and Chainguard Academy documents them clearly: you need a business email, your five picks are locked for the life of the plan, and any Helm charts you pull count against the allowance.
Minimus went the other way. Its Community Edition opened the entire gallery of more than 700 hardened images with no signup wall for basic pulls, each one continuously rebuilt from source and shipping a verifiable signed SBOM.
Get exclusive access to all things tech-savvy, and be the first to receive
the latest updates directly in your inbox.
Then there’s the option nobody puts in these comparisons. Canonical’s pricing page confirms Ubuntu Pro covers up to five physical machines free for personal use, with unlimited containers running on top, stretching to 50 machines if you’re an active community member. The community FAQ confirms that licence extends to small-scale commercial work too.
The locked five works in your favour here. Docker’s thousand-plus images already cover your nginx, your Postgres, your Node runtime; the ordinary furniture of a web stack. That frees you to spend Chainguard’s five on the awkward dependency nobody else bothers hardening, drawn from a catalogue spanning more than 2,100 open source projects.
Two providers. Nothing spent. Most of your gaps closed.
Every one of those terms is a promise, though, and promises in the registry business have a history worth reading.
The Registry Giveth
Judge a free tier by how you’d leave it. Joining is the easy part, and there’s a recent, thoroughly documented case to learn from.
From 28 August 2025, Bitnami moved its versioned public images into a read-only legacy repository that receives no further updates, keeping only latest-tagged hardened images free and labelling them for development use only. The GitHub announcement thread shows the full catalogue deletion was pushed back to 29 September after community feedback. Skyscrapers confirmed to its clients that security patching stopped for the public Bitnami namespace, and Chkk documented the brownouts during the changeover, where teams couldn’t predict which images would still be there in the morning.
That’s the whole lesson, and it costs you one afternoon to apply. Before you standardise on any provider, run three checks:
- Is the image published under a licence you can lean on, or a policy that can change next quarter?
- Does the base distro match something you already know how to debug at 11pm?
- If the free tier closed tomorrow, could you repoint your Dockerfiles before dinner?
Answer those and a security decision becomes an ordinary operational one, which is where you want it.
Bitnami didn’t do anything unusual, by the way. It just did it first, in public, and now every provider has to answer for its terms. That leaves the question of what moving actually involves for you.
One Line and Then Coffee
Migration is smaller than the folklore suggests, and the reward shows up in numbers you’re already tracking.
Docker built its hardened images on Debian and Alpine rather than inventing a distro, so your package manager habits carry over and the change is usually the FROM line. Docker also shipped an assistant that inspects your existing containers and suggests hardened equivalents, alongside hardened MCP server images for Grafana, MongoDB, GitHub and Context7.
None of this is new advice, incidentally; minimal base layers pulled from trusted sources have been the recommendation since NIST published its container security guide. What’s new is that you can follow it without a purchase order.
The payoff has independent backing, which is rarer than it should be in this corner of the market. Sysdig’s 2025 Cloud-Native Security and Usage Report, its eighth annual edition built from real customer telemetry, found container image size grew fivefold in a year while in-use vulnerabilities fell below six percent. Smaller base, quicker pulls, shorter patch queue, on hardware you’re paying for out of your own pocket.
a hardened base won’t protect you from a dependency you install yourself. Check Point’s research on the late-2025 npm campaign counted 621 infected packages and 25,000 affected repositories. Different problem, different fix; scanning, non-root users and the rest of the everyday Docker security habits still do that work for you.
If your pull is faster, your patching lighter and your bill unchanged, what’s the argument for staying on a general-purpose base?
Start Small and Stay Portable
After eight months of this, the leverage sits with you.
With providers competing on free access, the sensible position is running two of them, keeping your Dockerfiles dull enough that swapping a base takes minutes, and letting the vendors argue over SLAs you don’t need at your scale. Terms will keep moving; some tighten, some loosen. Anyone who kept their bases swappable will barely register the difference.
Pick by scope. Verify the exit. Migrate one service, watch it for a week, then do the rest.
