About CommonLayer
Why it exists
Most platforms build on the same open-source images and charts, often kept current by a few publishers. CommonLayer makes that layer a commons with named maintainers, public security deadlines, open funding and versions anyone can verify.
Principles
- Free to use
- Artifacts are free to pull and use whether or not anyone pays.
- Funding belongs to projects
- Money is held per project and allocated by a published policy, so maintainers can change without money moving.
- Pay for responsibility
- Maintainers are compensated for fulfilling their responsibilities over a period — never per vulnerability, never automatically.
- Verify, don't trust
- Artifacts are identified by digest, signed, published with SBOMs and provenance, and promoted only after the platform has verified them.
- Separate signals
- Security, maintenance and funding states are shown separately and never folded into one score.
- Real numbers only
- Every figure on the site comes from the ledger or the database. When something is not configured or not known, the site says so.
What it is not
- Not a vendor: there are no paid tiers, private variants or support contracts.
- Not a warranty: service levels are published policy enforced through eligibility, not a contractual guarantee.
- Not a fork of anyone's catalog: images and charts are built from upstream projects. Nothing is copied from other publishers' images, charts or scripts.
- Not a relicensing: image contents keep their upstream licenses.
The Bitnami alternatives catalog lists commonly requested replacements and is honest about which exist and which are only planned.
Open source
The platform, the project template, the build configuration and the charts are licensed under the Apache License 2.0. The design and implementation are documented in the documentation.
Security contact
To report a vulnerability in a CommonLayer image, chart or the platform itself, use the private reporting form. Reports are encrypted at rest and visible only to you, the project's security roles and the platform's security staff.