Competitive Comparison
Docker Hardened Images compared
Docker Hardened Images (DHI) are free under Apache 2.0. Paid Select starts at $5k per repo with a 7-day critical and high CVE SLA, and Enterprise adds Extended Lifecycle Support for up to five years past upstream end of life. Chainguard and Bitnami Secure Images are paid, and OSSeva patches pinned end-of-life versions in the Bitnami layout.
Checked 30 October 2026 against docker.com, Docker's DHI service level agreement, chainguard.dev, edu.chainguard.dev, bitnami.com and Broadcom's Bitnami announcement. Every vendor statement on this page comes from those pages; confirm with each vendor before you buy. Chainguard and Bitnami are covered in full on their own comparison pages. Next review by 23 November 2026.
Where OSSeva is stronger
- ✓Patched images for end-of-life versions in the Bitnami layout: PostgreSQL 11 to 14, Kafka 2.8 to 3.9, RabbitMQ 3.8 to 3.13, MongoDB 4.2 to 6.0
- ✓Fixes backported into the database or broker itself, not only a rebuilt image
- ✓Existing Bitnami Helm charts keep working after a registry change; DHI uses Docker's own layout
- ✓Support and 24/7 operations for the software inside the image (Operate tier)
Where Docker Hardened Images is stronger
- →Price: the full hardened catalog is free under Apache 2.0, with no usage restrictions, against a subscription per image family
- →Catalog breadth: Docker lists 1000+ images on Alpine and Debian, against OSSeva's seven image families
- →SLSA Build Level 3 provenance, signed SBOMs and OpenVEX data on the free tier
- →FIPS and STIG variants and up to five years of Extended Lifecycle Support past upstream end of life on Enterprise
Trusted globally by enterprises
Four options side by side
Prices are the figures each vendor publishes. Chainguard and Bitnami have their own pages with the full terms; this table keeps only what changes the choice.
| Docker Hardened Images | Chainguard | Bitnami Secure Images | OSSeva | |
|---|---|---|---|---|
| Free tier | Whole catalog, Apache 2.0 | About 50 images at :latest, no CVE SLA | Development images at the latest tag only | None |
| Published price | Select from $5k per repo; Enterprise by quote | Catalog from $19K for a team of 10; per image by quote | None; quote via Broadcom sales | None; subscription per image family |
| Contractual CVE SLA | Critical and high 7 days, medium and low 30 (Select, Enterprise) | Critical 7 days, others 14 | Not published | Critical 48 hours, High 7 days |
| Past upstream end of life | ELS add-on, up to 5 years, Enterprise only | Grace period, up to 6 months | Long-term support versions; list not published | Patched end-of-life lines, backported |
| Base and layout | Alpine or Debian, Docker layout | Chainguard OS, minimal | Photon, Bitnami layout | Bitnami layout |
| Catalog | 1000+ images | 3,000+ images | 350+ images, 140+ charts | 7 image families |
Sources: docker.com, Docker's DHI SLA, chainguard.dev/pricing, bitnami.com, read 30 October 2026. Details: OSSeva vs Chainguard, OSSeva vs Bitnami Secure Images.
Long-term support windows
What each vendor does once upstream stops patching a version is the question most image buyers have not asked yet. The four answers differ in length, in who does the work and in how much the vendor publishes.
| Option | Window | What is patched | What is not published |
|---|---|---|---|
| Docker Hardened Images ELS | Up to 5 years after upstream end of life | Critical and high within 14 days, medium and low within 45, where the image can be rebuilt to mitigate the CVE | Price and the list of eligible versions |
| Chainguard EOL grace period | Up to 6 months, with no exceptions | Other packages in the image; the end-of-life primary package is not updated or backported | Not applicable: the rules are published |
| Bitnami Secure Images | Subscription includes long-term support versions | Not published | Which end-of-life versions, and for how long |
| OSSeva Patch | Per contract | Fixes backported into PostgreSQL 11 to 14, Kafka 2.8 to 3.9, RabbitMQ 3.8 to 3.13, MongoDB 4.2 to 6.0 and more | No end date is stated per line on this site |
Sources: Docker's DHI service level agreement (section 10, ELS); edu.chainguard.dev EOL grace period; Broadcom's Bitnami announcement of 18 August 2025; OSSeva supported versions. Read 30 October 2026.
Capability comparison
Comparison of OSSeva with Docker Hardened Images, from Docker's product pages and service level agreement read 30 October 2026. The four-way table above adds Chainguard and Bitnami. Verify current terms with Docker.
| Capability | OSSeva | Docker Hardened Images |
|---|---|---|
| Free tier | Whole catalog, Apache 2.0 | |
| Patched images for end-of-life versions | ELS add-on, Enterprise tier only | |
| Fixes backported into the end-of-life database or broker | Image rebuilt to mitigate the CVE | |
| Works with existing Bitnami Helm charts | Not stated; Docker layout differs | |
| Contractual CVE SLA | Critical 48 hours, High 7 days | Critical and high 7 days (Select and Enterprise) |
| FIPS and STIG variants | Select and Enterprise | |
| SLSA Build Level 3 provenance | ||
| Signed images with SBOM | ||
| Catalog size | 7 image families | 1000+ images |
| Support for the software inside the image | Image-level SLA | |
| 24/7 managed operations | Not listed | |
| Pricing model | Subscription per image family | Free; Select from $5k per repo; Enterprise by quote |
How the price models differ
Docker's model is free for the catalog and paid for assurances: the SLA, compliance variants and customization. Chainguard's is paid by image count and type, or by engineering team size for the whole catalog, with a small free set. Bitnami Secure Images is sold through Broadcom sales with no list price. OSSeva is a subscription per image family, and this page carries no OSSeva price.
Price drivers in each case are the number of repos or images, whether you need FIPS or STIG variants, how many customizations you need and whether any of your versions are past upstream end of life. Only the last of those moves you from a catalog subscription to a support contract.
Which should you pick?
| Your situation | Pick | Why |
|---|---|---|
| Current versions, no compliance variants needed | DHI Community | Free, Apache 2.0, SLSA Build Level 3 and SBOMs included. |
| Current versions, SLA and FIPS or STIG variants required | DHI Select or Chainguard | Both publish a contractual SLA and compliance variants. |
| Bitnami charts on current versions, minimal change | Bitnami Secure Images | Same charts and layout, sold by Broadcom. |
| Pinned end-of-life versions in the Bitnami layout | OSSeva | Patched lines for seven families, charts unchanged. |
| End-of-life versions, ready to adopt Docker's layout | DHI Enterprise with ELS | Up to five years in the same catalog. |
Sources, checked 30 October 2026
| Page | Address |
|---|---|
| Docker Hardened Images | docker.com/products/hardened-images/ |
| Docker pricing | docker.com/pricing/ |
| Docker DHI service level agreement (PDF) | docker.com/static/support-service-level-agreement-for-dhi.pdf |
| Docker press release, 17 December 2025 | docker.com/press-release/docker-makes-hardened-images-free-open-and-transparent-for-everyone/ |
| Chainguard pricing | chainguard.dev/pricing |
| Chainguard EOL grace period | edu.chainguard.dev/chainguard/containers/concepts/lifecycle-and-eol/eol-grace-period/ |
| Bitnami Secure Images | bitnami.com/ |
| Broadcom: preparing for the Bitnami changes | community.broadcom.com/blogs/beltran-rueda-borrego/2025/08/18/how-to-prepare-for-the-bitnami-changes-coming-soon |
Why teams choose OSSeva
Pinned end-of-life versions in the layout you already use
DHI is built on Alpine and Debian with Docker's own layout, so a Bitnami chart needs changes before it runs. OSSeva images keep Bitnami's environment variables, /bitnami data paths and non-root user, so you change the image registry in your values file and keep the version you pinned. OSSeva backports fixes into PostgreSQL 11 to 14, Redis 6.x and 7.2, Kafka 2.8 to 3.9, ZooKeeper 3.6 to 3.8, RabbitMQ 3.8 to 3.13, MongoDB 4.2 to 6.0 and Elasticsearch 7.10.2 and 7.17.
A fix inside the package, not only a rebuild
Docker's ELS terms make a CVE eligible when an image can be rebuilt to mitigate it, and Docker commits to commercially reasonable efforts within 14 days for critical and high findings. OSSeva Patch backports the fix into the end-of-life database or broker and commits to Critical CVEs within 48 hours and High within 7 days.
Someone to call about what runs in the container
An image subscription keeps the container patched. It does not tell you why a RabbitMQ node partitioned or a Kafka controller stalled. OSSeva engineers support the broker or database itself, and the Operate tier puts them on call for your clusters 24/7.
Why teams choose Docker Hardened Images
Free, open and broad
On 17 December 2025 Docker made its hardened image catalog free and open source under Apache 2.0, with no paywalled versions or usage restrictions. Every tier, including Community, ships signed SBOMs, SLSA Build Level 3 provenance and OpenVEX data. For current versions on Alpine or Debian, nothing OSSeva sells competes with free.
Compliance variants and a stated SLA
Select adds FIPS-validated and STIG-aligned variants, up to five customizations and an SLA of 7 calendar days for critical and high CVEs and 30 for medium and low. Docker measures that from the date it determines a CVE has an eligible fix, and promises commercially reasonable efforts.
Extended Lifecycle Support in the same catalog
The ELS add-on needs the Enterprise tier and runs up to five years past upstream end of life. Docker's SLA gives critical and high CVEs 14 calendar days and medium and low 45. If you are ready to move to Docker's layout, it is the closest equivalent to OSSeva for end-of-life software. Docker does not publish an ELS price or the list of versions it covers.
Which is right for your situation?
Choose OSSeva when…
Your charts pull pinned end-of-life versions of PostgreSQL, Redis, Kafka, ZooKeeper, RabbitMQ, MongoDB or Elasticsearch, often from bitnamilegacy, and you need them patched without rewriting charts, or you want the runtime supported and operated, not only the image.
Talk to an engineerConsider Docker Hardened Images when…
You run current, upstream-supported versions on Alpine or Debian and want free hardened images, or you need FIPS and STIG variants, or you will adopt Docker's layout and want ELS from the same vendor.
Docker Hardened Images lists 1000+ images on Alpine and Debian. Chainguard and Bitnami Secure Images are compared on their own pages. OSSeva covers seven data and messaging image families, including end-of-life versions.
Frequently asked questions
Are Docker Hardened Images free?
Yes. Docker made the full catalog free under Apache 2.0 on 17 December 2025, with no usage restrictions. The paid tiers add an SLA, compliance variants and customization: Select is listed at $5k per repo, with the billing period not stated, and Enterprise is by quote.
How much do Docker Hardened Images cost?
Docker's pricing page, read 30 October 2026, lists Community as free, Select as starting at $5k per repo and Enterprise as contact us for pricing. The Extended Lifecycle Support add-on has no price and requires Enterprise. OSSeva is a subscription per image family and publishes no price list.
Chainguard or Docker Hardened Images?
For current versions, both are minimal hardened images. Docker's catalog is free under Apache 2.0, while Chainguard lists about 50 free images at the latest tag, outside its CVE SLA, and charges for the rest. Chainguard's paid SLA is 7 days for critical and 14 for the others. The Chainguard comparison covers its terms in full.
What does DHI Extended Lifecycle Support cover?
Up to five years of hardened updates after upstream end of life, as an add-on to the Enterprise tier. Docker's SLA gives critical and high CVEs 14 calendar days and medium and low 45, for CVEs where the image can be rebuilt to mitigate them. Docker does not publish which versions are eligible.
Which provider offers long-term support for container images?
Docker (ELS, up to five years, Enterprise), Chainguard (a grace period of up to six months, with no backport to the end-of-life package), Bitnami Secure Images (a subscription that Broadcom says includes long-term support versions, with no published list) and OSSeva (patched end-of-life lines for seven image families). Ask each for the exact versions in writing.
Is Bitnami still free?
Only a small development tier. Versioned Bitnami images moved to Bitnami Legacy, an archive Broadcom calls unsupported and temporary, and the free images are available at the latest tag for non-production use. See the Bitnami comparison for the dates and terms.
Get a quote
Ready to see if OSSeva covers your stack?
Send your work email and a senior engineer will confirm version coverage. Reply within 1 business day.
Prefer to talk or read more first?