Bitnami Images No Longer Get Updates: Find and Replace Them in 30 Minutes

Why it matters now

Bitnami, now part of Broadcom, began restructuring its public container catalog on 28 August 2025, with planned brownouts until 19 September 2025.¹ Bitnami postponed the deletion of the public catalog to 29 September 2025.⁵ The versioned images now sit in the bitnamilegacy archive, which receives no further updates.¹

Running pods kept their images, so nothing failed on the day. Many teams then fixed broken chart upgrades with one override, such as --set image.repository=bitnamilegacy/postgresql, which Bitnami suggested as a transition step.² The override kept deployments working and froze each component at its last patch level.

The components Bitnami covered well are the ones you least want frozen: databases, message brokers, caches and identity services. They hold data, and many workloads reach them.

Check your clusters and repositories in 30 minutes

Step 1. Find what runs in each cluster

Run this on every cluster. It includes init containers.

kubectl get pods -A -o json \
  | jq -r '.items[] | .metadata.namespace as $ns
      | (.spec.containers + (.spec.initContainers // []))[]
      | "\($ns)\t\(.image)"' \
  | grep -E 'bitnami(legacy)?/' | sort -u

Step 2. Find what your repositories reference

Run this at the root of each repository. It also covers components deployed later and Dockerfiles built FROM bitnami/..., which inherit the same position one layer down.

grep -rnE 'bitnami(legacy|charts)?/|charts\.bitnami\.com' \
  --include='*.yaml' --include='*.yml' --include='Chart.lock' \
  --include='Dockerfile*' --include='*.tf' .

Step 3. Sort the results

Put each result in one of three groups: running on bitnamilegacy, running on bitnami with the latest tag, or referenced only in code.

What the result means

A practical order of replacement: components that face the internet or handle identity, then databases and message brokers that hold customer data, then caches and internal services, and last, tools used only in development.

The move, step by step

1. Inventory. Combine the results of the checks into one list, with an owner for each item.
2. Decide per component. Choose a managed service, an operator, an upstream or hardened image, a self-built image or the paid subscription. Start with databases.
3. Mirror into your own registry. Copy replacement images into a registry you control, such as Amazon ECR, Artifact Registry or Harbor.
4. Pin by digest. Reference images by their sha256 digest, and let a bot such as Renovate or Dependabot propose updates.
5. Scan and sign. Scan every image before it reaches the registry, generate a software bill of materials (SBOM) at build time, and sign the result.
6. Block the old sources. Add an admission policy that rejects images from bitnamilegacy and from registries outside your mirror.

Replacement options include managed cloud services, community operators such as CloudNativePG, Docker Official Images, Docker Hardened Images (free and open source since December 2025)³, images you build from the Bitnami source on GitHub, and the paid Bitnami Secure Images subscription. A mirror also removes the dependency on Docker Hub, which limits anonymous pulls to 100 per six hours per network address.⁴

What is still open

• Bitnami catalog terms and the scope of the paid subscription can change. Please confirm the current terms before a purchase decision.
• Docker Hardened Images coverage grows over time. Check the catalog for your exact components and versions.
• Docker Hub pull limits have changed several times. The figure in this note reflects the Docker documentation as of October 2026.

A note to forward to your team

Bitnami images check

Since 28 August 2025, versioned Bitnami images sit in an archive that receives no security fixes. Some of our components may still run on them.

Please run the checks in this note on every cluster and repository by [date] and reply with three numbers:
1. Workloads on bitnamilegacy images
2. Workloads on bitnami images with the latest tag
3. Bitnami references found only in code

Owner: [name]
Note: https://stonetusker.com/insights/bitnami-image-changes.html