Docker Review

Docker raised a $105M Series C at a $2.1B valuation in 2022, and 91% of the Fortune 100 already run on it. A platform this entrenched in CI/CD pipelines is not a vendor a board needs convincing on.

The strategic read is the December 2025 move that made Docker Hardened Images free and Apache 2.0 licensed, with near-zero CVEs, up to a 95% smaller attack surface and SLSA Level 3 provenance. That undercuts Chainguard on price for the same supply-chain assurance, and it pulls security work back into a tool teams already run. DHI Enterprise still sells SLA-backed remediation for organizations that need it.

The catch is that container orchestration at scale belongs to Kubernetes, not Docker Swarm, so this is a build-and-ship layer, not a platform bet. That is fine. Standardize Docker Desktop and the hardened images now, and treat the Enterprise tier as a later compliance decision.

For a CTO choosing platform tooling through 2029, the foundation matters more than the desktop app. Docker created the container category in 2013, and its runtime pieces — containerd and runc — became the OCI-standardized layer Kubernetes itself consumes. Standardizing here means standardizing on an open format, not a proprietary artifact.

The strategic signal is the supply-chain move. Docker Hardened Images went free and Apache 2.0–licensed in December 2025, shipping near-zero-CVE images with SLSA Level 3 provenance and complete SBOMs. That turns image hardening from a paid Chainguard contract into a default, which is a genuine three-year shift in how teams treat container security.

The catch is the desktop layer. Docker Desktop is per-seat, and Business runs $24 per user monthly, so the lock-in lives in the local tooling, not the runtime. Podman is a credible daemonless alternative for that exact reason, but it does not match Docker Hub's 14M-image gravity.

Docker prices in the open. Four tiers, Personal through Business, no quote required. Pro is $9/user/month on annual billing ($11 monthly), Team $15 ($16 monthly), Business $24 on annual billing. Procurement won't fight this one.

TCO math. A team of 50 on Business lands at $24 x 50 x 12 = $14,400/year. Team tier at $15 cuts that to $9,000, but Enhanced Container Isolation and policy enforcement are Business-only. The catch is the free tier: Docker Personal carries commercial-use limits, so growth quietly moves headcount onto paid seats. Compare GitHub, which bundles container hosting into existing plans.

ROI is measurable. Docker Build Cloud meters 1,500 minutes monthly on Business, with overage minutes purchasable. Docker Hardened Images ship near-zero known CVEs and up to a 95% smaller attack surface, a real audit-cost line. Docker, Inc. has shipped since 2013, so vendor risk is low.

The daemon is the first thing an engineer notices. Docker still runs a privileged background process, and Podman's daemonless, rootless design exists precisely because that bothers security-conscious teams. But the docker compose up muscle memory and Docker Desktop's parity across Mac, Windows, and Linux keep most teams from ever switching.

Docker Compose for Agents is the genuinely new workflow: one file, one command to launch models, tools, and agents together. The CLI takes --format json on list commands like docker ps, so scripting CI stays honest. Docker Hub holds 14M+ images, and the docs read like they were written by people who actually debug failed builds, not by marketers.

The shift worth knowing: Docker Hardened Images went free and Apache 2.0 in December 2025, with 1,000+ near-zero-CVE images and attack surfaces up to 95% smaller. The catch is that distroless images strip the shell, so docker exec debugging in production stops working. That is a real day-three habit change.

Some tools you learn once and never think about again. Docker has been that for a decade. It went open-source in March 2013, and the verb stuck so hard people forget there was a before. Docker Desktop spins up containers on Mac, Windows, and Linux with the same commands.

What keeps it from feeling dated is that the team kept sweating the details. Docker Hardened Images strip distroless builds down and cut the attack surface by up to 95%, a real daily win, not a slide. Docker Hub holds 14M+ images, so the thing you need is usually already there.

Podman pitches a lighter, daemonless alternative, and it is genuinely good. But Docker still owns the muscle memory and the docs everyone has read. The catch is the Business tier at $24 per user per month, which adds up fast once a team needs SSO and policy enforcement.

Most "category-defining" tools are gone in five years. Docker is the rare one that wired itself into the floor. The container format became the standard, and Docker Hub still hosts 14M+ images and serves 20B+ pulls a month.

The company itself had a near-death. It sold Docker Enterprise to Mirantis in 2019 and cut deep. What survived is a freemium subscription — Pro runs $9 per month annually, up from $5. The newer Docker Hardened Images push is a real pivot toward supply-chain security, claiming near-zero CVEs and up to a 95% smaller attack surface. But that is marketing math until an audit confirms it.

Exit is the strongest signal here. The image format is an open standard, so Podman runs the same containers and Kubernetes orchestrates them natively. You are not locked in. The yellow flag is that Docker the company sells convenience around a commodity it no longer owns.