// Bitnami drop-in images
Still pulling from bitnamilegacy?
Those images stopped getting security updates in 2025.
Bitnami drop-in images from OSSeva are patched, signed images that keep Bitnami's environment variables, data paths and non-root user, so you change a registry reference and your Helm charts keep working. They cover PostgreSQL, Redis, Kafka, ZooKeeper, RabbitMQ, MongoDB and Elasticsearch, including versions past upstream end of life. When Broadcom retired the free catalogue, pinned versions moved to bitnamilegacy, which Docker Hub labels as no longer updated and which had 18.5 million pulls of postgresql, 16.6 million of redis and 15.5 million of kafka on 20 October 2026. The official replacement images use different variables, paths and entrypoints, so switching breaks charts. Enter your work email and the images you run, and an engineer replies within 1 business day.
- Covered
- PostgreSQL 11 to 14, Redis 6.x and 7.2, Kafka 2.8 to 3.9, ZooKeeper 3.6 to 3.8, RabbitMQ 3.8 to 3.13, MongoDB 4.2 to 6.0, Elasticsearch 7.10.2 and 7.17
- Critical CVEs (CVSS 9.0 or higher)
- Patched within 48 hours
- High-severity CVEs
- Patched within 7 days
- Support hours
- Assure includes 24/7 reactive support; Operate adds a 15-minute P1 response
- Each build ships with
- A signature, an SBOM and a VEX statement
Trusted globally by enterprises
Why teams are still on bitnamilegacy
Moving off Bitnami looks like a registry change. In practice it touches every chart and every values file that assumed Bitnami's conventions.
The official images are not drop-in
Bitnami images use their own environment variables (POSTGRESQL_*, REDIS_PASSWORD, KAFKA_CFG_*), their own data paths under /bitnami, and non-root defaults. The official images differ on all three, so charts and operators that were written for Bitnami break on the switch.
The versions you pinned are exactly the ones nobody patches
Production pins versions for good reasons: an application certified on PostgreSQL 13, a Kafka cluster still on ZooKeeper, a RabbitMQ 3.x estate mid-migration. The free alternatives publish current versions; the end-of-life versions you actually run are the gap.
Legacy pulls keep working, which hides the problem
Images in the bitnamilegacy archive still pull, so deployments keep succeeding. Scanners report the growing CVE count, but nothing breaks, so the migration keeps slipping.
The dates that matter
2025-07-16
Bitnami announces the catalogue change on its containers repository.
2025-08-28
Versioned tags move to docker.io/bitnamilegacy, which gets no further updates. Brownouts of the public catalogue begin.
2025-09-29
The public catalogue is removed. Older images move to the bitnamilegacy archive, which receives no further security updates.
2026-06-10
Broadcom removes Bitnami containers, Helm charts and AMIs from AWS Marketplace, Lightsail and ECR.
2026-08-31
Bitnami Secure Images becomes part of Broadcom's TrueSource portfolio.
2026-10-22 (announced)
Minimus, another hardened-image provider, has announced it will cease operations and turn off its registry on this date.
What OSSeva delivers
Bitnami-compatible images
The same environment variables, paths, users and entrypoint behaviour as the Bitnami images you run, so existing charts and values files work after a registry change.
Patched EOL versions
Security fixes backported into the application and the base image for versions past community end of life, rebuilt when new advisories land, and signed.
Chart migration
An inventory of every bitnami and bitnamilegacy reference across your clusters and a repoint to OSSeva images, chart by chart.
Which options keep Bitnami Helm charts working for pinned versions?
| Option | What you get | Trade-off |
|---|---|---|
| Official upstream images | Free, maintained images for current versions | Different conventions mean chart changes, and EOL versions are not maintained. |
| Bitnami Secure Images | Maintained Bitnami images from Broadcom | A commercial subscription, now packaged with TrueSource, with no public list price. Broadcom does not publish which end-of-life versions it patches. |
| Docker Hardened Images | Free hardened current images; a paid Extended Lifecycle Support tier adds five years past upstream EOL | Docker's own image layout, so Bitnami charts still need changes. |
| Other hardened-image vendors | Minimal, hardened current-version images | Most focus on current releases and their own image layout. |
| OSSeva drop-in images | Bitnami-compatible, patched images including EOL versions | A subscription per image family. |
| Stay on bitnamilegacy | Nothing new | Every advisory since the archive froze stays open in production. |
Dates from the Bitnami containers repository announcement, Broadcom's notices and Docker Hub, checked 20 October 2026.
What replaces bitnamilegacy images?
For current versions, the official upstream images or Bitnami Secure Images. For end-of-life versions, and for teams that want to keep Bitnami's layout so charts keep working, OSSeva ships patched drop-in images.
Do OSSeva images work with Bitnami Helm charts?
Yes. They keep Bitnami's environment variables, paths, users and entrypoint behaviour, so you change image.registry and image.repository in your values and leave the rest.
Are bitnamilegacy images still getting security updates?
No. The legacy archive receives no further updates, with few exceptions. The images still pull, so deployments keep working while vulnerabilities accumulate.
Which images are covered?
The data and messaging images OSSeva already patches: PostgreSQL, Redis, Kafka, ZooKeeper, RabbitMQ, MongoDB and Elasticsearch, including end-of-life versions. Send us your image list and we map each one to its drop-in replacement.
How are the images delivered?
From a private registry, signed, with an SBOM and a VEX statement for each build, or mirrored into your own registry.
How fast are new advisories patched?
Critical advisories within 48 hours and High within 7 days. Assure includes 24/7 reactive support; Operate adds managed operations with a 15-minute P1 response.
Get a quote
Repoint the registry, keep the charts.
Send us your image list. We confirm coverage and send a migration plan within five working days.
Prefer to talk or read more first?