David Brooks
The $207M Business Model Docker Doesn't Lead With
December 17, 2025: Docker announced it was releasing 1,000+ Docker Hardened Images (DHI) as open source under Apache 2.0 license. Headlines celebrated "free for everyone."
Docker generates $207 million annually from Docker Desktop — the product that companies with 250+ employees MUST buy at $21/user/month.
Let's do the math nobody else does. You have 100 developers. Docker Desktop Business costs $21/user/month. That's $25,200 per year just for the debugging tool — before paying a cent for DHI Enterprise (whose price Docker doesn't publicly disclose). The 250-employee OR $10 million revenue threshold captures most enterprises, and Docker went from $20M in 2021 to $207M in 2024 with this model.
DHI requires mandatory Docker login. For full debugging — the workflow any dev needs to troubleshoot containers — you need Docker Desktop. This isn't open source charity. It's textbook lead generation for a $207M ARR product that grew 125% in two years. I've been tracking this space for over a decade, and I recognize customer acquisition when I see it.
The "free" images have an asterisk the size of a whale: only if you're small (<250 employees AND <$10M revenue). Cross that threshold, and welcome to Docker's paid ecosystem: Desktop, Hub Team, Scout, Build Cloud. DHI gets you into the most effective conversion funnel I've seen in cloud infrastructure.
What SRLabs Actually Found (And What Docker Omits)
Docker Hardened Images reduce vulnerabilities up to 95% vs official images. In one documented case, DHI eliminated 25 CVEs from an official image and brought it to zero. Attack surface dropped 90% (from 321 packages to 32), and image size fell 41.5% (from 82 MB to 48 MB). The numbers are impressive because 98% of vulnerabilities live in OS packages (Debian in this case), not the application layer.
| Metric | Official Image | DHI | Improvement |
|---|---|---|---|
| Total CVEs | 25 | 0 | 100% |
| OS packages | 321 | 32 | 90% |
| Image size | 82 MB | 48 MB | 41.5% |
| Provenance | No | SLSA Level 3 | N/A |
SRLabs — a leading cybersecurity firm — validated DHI in December 2025.
Docker celebrates zero critical CVEs in every press release. SRLabs recommended pending improvements that marketing prefers to bury: (1) move signing keys to HSM with quorum controls, (2) implement keyless Fulcio flow for better operational security, (3) improve offline signature revocation, (4) eliminate privileged builds to ensure deterministic reproducibility.
Zero critical CVEs found is excellent. The independent audit also exposed room for improvement in supply chain security that Docker hasn't closed yet. Transparency they'd rather bury in technical PDFs than mention alongside "validated by SRLabs" in marketing materials.
The RHEL Gap: Why 40% of Enterprises Can't Use DHI
Running Red Hat Enterprise Linux? CentOS? Ubuntu with commercial support?
You're out of luck.
Docker Hardened Images only support Debian and Alpine. Period. There's no public roadmap for RHEL, and that's a massive problem for enterprises in regulated industries. Banks, healthcare, government contractors — sectors where security justifies paying $72,000/year for Bitnami Secure — require commercial distros with vendor support. RHEL has support contracts, SLAs, compliance certifications that Alpine simply doesn't offer. Here's my take: this limitation excludes a huge percentage of the market that would pay most for DHI Enterprise.
Chainguard reports that Red Hat UBI (Universal Base Images) averages ~200 CVEs per image. Docker could harden RHEL and charge a premium to enterprises that need it. They chose Debian/Alpine — distros popular in startups and open source, not in Fortune 500 companies with compliance teams demanding RHEL + Red Hat subscription.
Bitnami Secure (now VMware/Broadcom): supports RHEL UBI in addition to Debian/Alpine, includes FIPS/STIG/FedRAMP configurations, costs $72,000/year but covers the full compliance stack that regulated industries need. Docker DHI Enterprise promises "FIPS images" and "STIG-ready configurations" on their roadmap, but without RHEL as the base, how do they compete for that market?
Base distro matters (a lot). It's not just "technical preference." It's the difference between passing compliance audits or getting rejected in procurement.
Chainguard's Inverse Strategy: Who Wins the $9B Race
May 2025: Docker launches DHI as a paid commercial product.
December 2025: Docker releases it free as Apache 2.0.
What happened in between? Broadcom acquired Bitnami and raised pricing to $72,000/year effective August, completely eliminating the free tier that millions of developers relied on. Docker saw the opportunity. Bitnami left a massive void — free hardened images the community depended on disappeared overnight. Docker enters with 1,000+ "free" images right when developers are seeking alternatives.
Perfect timing or calculated strategy. I'm betting on the latter.
Chainguard does $40 million annually (640% year-over-year growth) with the OPPOSITE model: latest images free, historical versions paid. Docker gives historicals free (Apache 2.0), charges for enterprise features (7-day SLA for critical CVEs, Extended Lifecycle Support, customization). They're opposing philosophies attacking the same container security market that Mordor Intelligence projects will grow from $3B (2025) to $9B (2030).
Who wins? Depends on your use case. If you're a startup <250 employees running latest in production, Chainguard latest free + Docker DHI free cover you at zero cost. If you're an enterprise that needs to maintain specific versions for compliance and requires remediation SLAs, you pay: Chainguard for historical images, Docker for DHI Enterprise (plus Desktop if you have 250+ employees).
Let's acknowledge the obvious: neither Docker nor Chainguard does this out of altruism. DHI "free" is a lead magnet for Desktop subscriptions ($207M ARR) and DHI Enterprise (pricing undisclosed). Chainguard latest "free" is freemium to convert you into a $40M ARR customer. Both models are valid. I just find it frustrating when they disguise customer acquisition as open source generosity.
Here's My Take: Solid Tech, Questionable 'Free'
Here's my take: Docker Hardened Images are technically solid. 95% CVE reduction verified by SRLabs, Apache 2.0 license with no restrictions, SLSA Build Level 3 provenance, rootless by default. If you use Debian or Alpine and you're a small company (<250 employees), this is a free upgrade you should implement today.
You run infrastructure at a 250+ employee company. The real costs:
- Docker Desktop Business: $21/user/month × 100 devs = $25,200/year (mandatory for debugging)
- DHI Enterprise: pricing undisclosed, requires sales contact (likely $20K-$50K/year based on market comps)
- Total: ~$45,000-$75,000/year before considering Hub Team, Scout, Build Cloud
Compare that to Bitnami Secure ($72,000/year all-in with RHEL support). Chainguard (custom pricing, but $40M ARR / enterprise customers suggests similar ticket sizes). Docker isn't "free" for enterprises. It's competitively priced with soft lock-in to the Desktop ecosystem.
Recommendation? Implement DHI if you're already in the Docker ecosystem and use Debian/Alpine. The CVE reduction is real and improves your security posture. Go in with eyes open: you're accepting Docker Desktop dependency (hidden cost) and limitation to two distros (blocker for many enterprises). If you need RHEL or want to avoid vendor lock-in, evaluate Chainguard or stick with Bitnami Secure if you're already paying for it. I haven't had access to DHI Enterprise pricing — Docker requires direct sales contact for quotes. The ranges I mention ($20K-$50K/year) are based on market comparables (Chainguard, Bitnami), not direct confirmation from Docker.
Marketing "free for everyone" when the 250-employee threshold converts most companies into paying customers is unacceptable. After a decade covering enterprise tech, I value transparency. Docker has a solid product. They don't need to disguise lead generation as charity.
