Tanzu Application Catalog is the enterprise version of the open source Bitnami Application Catalog. Built by leveraging Bitnami’s expertise in packaging hundreds of open source software applications and delivering them to millions of developers, Tanzu Application Catalog gives enterprises stronger control and deeper visibility into their open source software supply chains, while allowing their developers to enjoy their familiarity with Bitnami packages.
Tanzu Application Catalog Key Capabilities
Leverage enterprise-grade, pre-packaged, open source software with full confidence.
Leading-edge security practices
Tanzu Application Catalog provides a private catalog of open source software, packaged following Bitnami's renowned practices on an SLSA3-compliant pipeline with verifiable signatures and rich metadata to help you inherently improve your security posture.
Read our documentation
Rich, actionable
metadata
The comprehensive metadata provided in the form of Vulnerability Exploitability eXchange (VEX) documentation, Software Bills of Materials and CVE scan results helps eliminate false positive CVE reports and achieve efficient management of risks posed by upstream vulnerabilities.
Advanced customization options
Customize the open source software you need at the base operating system (OS), language runtime and application layer levels. These customizations are baked into our delivery pipeline to ensure that the customized open source software you need is delivered as fully production-ready artifacts.
Read our blog
Production readiness
The open source software applications in the catalog are consistently packaged including all necessary dependencies and configurations, put through rigorous functionality and performance tests across multiple platforms, and delivered to you ready to deploy.
Continuous, automated maintenance
All open source software lifecycle management activities like security patching, version upgrading and dependency management are executed behind the scenes through automated processes, enabling your developers to focus on business innovation.
A lean and secure base image
Get the option to use Photon OS, a VMware-maintained lean and lightweight Linux distribution, as the base operating system, and procure open source software application components with minimal vulnerabilities.
Why Tanzu Application Catalog?
Move faster by leveraging secure, open source components for app development.
Developer convenience
Developers can rapidly innovate with a self-service catalog of ready-to-deploy open source building blocks such as application components, databases and runtimes.
Platform engineering confidence
Platform engineers can gain the confidence that the open source software used by their development teams have minimal vulnerabilities, conform to enterprise security requirements, and are custom-configured per their requirements.
How do I use Tanzu Application Catalog?
Accelerate application development with a catalog of ready-to-use open source containers, Helm charts and virtual machine images.
Choose your application
Browse an extensive library of 100+ production-ready open source software images which include all the necessary building blocks of modern applications like databases, language runtimes, message streaming services and API gateways so you can build your own custom catalog. Choose the form factor you need for each application in your curated catalog: container image, Helm chart or virtual machine.
Explore the catalog
Customize per your requirements
For each application's base OS, either use VMware's lightweight Linux distribution, Photon OS, or choose from any of the other options we provide: Red Hat UBI, Ubuntu or Debian. You can also choose your own OS. Carry out any other language runtime or application level customizations as per your needs. Tanzu Application Catalog builds the applications in your curated catalog according to your customizations and tests them across all major Kubernetes platforms.
Read our documentation
Deploy anywhere with confidence
Applications in your custom catalog are delivered as ready-to-deploy artifacts to a private registry of your choice or a VMware-hosted registry along with a comprehensive set of metadata including VEX, SBoMs and CVE scan reports. You can then deploy the applications without security-related issues, as the latest security patches and version upgrades are automatically delivered to you once they are available upstream.
Use Cases
Achieve strong compliance with regulatory norms
Enable your developers to work with the open source software they need without worrying about regulatory compliance. Tanzu Application Catalog helps you improve your compliance posture by providing SLSA3-compliant open source software, STIG-compliant base image options and VEX documentation per CISA (Cybersecurity and Infrastructure Security Agency) guidelines.
Automate day 0 and lifecycle management of open source software
All open source software-related day 0 and lifecycle management activities like packaging, patching, updating and baseline configuration activities are carried out by Tanzu Application Catalog, reducing developer toil and enabling them to focus on software development.
Reduce security risks posed by open source
Our continuously-running build pipeline ensures that all security patches and open source software upgrades are made available to you as soon as they are released upstream.
Improve security decision making
Use the comprehensive metadata provided by Tanzu Application Catalog and get all the information you need for reliable and efficient upstream risk management and a stronger security posture.
Standardize use of open source software to reduce complexity
Reduce the complexities associated with open source software and establish standardization by building a curated catalog for your development teams—configuring and customizing the applications to include enterprise tools and agents.
Streamline open source vendor dependencies
Avoid the hassle of having to deal with multiple open source software vendors. Instead, you can rely on the expertise of Bitnami and VMware to get your developers up and running with the open source software they need and love.
“We are pleased to work [with] VMware, which has enabled a protected and trusted ecosystem that allows our teams to focus their energy on further business demands.”
Olivier Lagarde, Lead Technical IT Infrastructure Policy for Satellite Ground System, Airbus Defence and SpaceFrequently Asked Questions
What is Tanzu Application Catalog?
Tanzu Application Catalog, a component of Tanzu Platform, enables customers to build their own private catalog of custom-packaged open source application components that are continuously maintained and verifiably tested for use in production environments.
Which applications can I choose for my catalog?
You choose any application in our curated catalog. You can find all our applications at app-catalog.vmware.com/catalog.
Which base operating system images can I choose for my applications?
Tanzu Application Catalog provides out-of-the-box support for using the latest versions of Photon OS, Ubuntu, Red Hat UBI and Debian as the base image of your applications. Alternatively, you can use your own base image. View the list of base operating systems supported by Tanzu Application Catalog
What is the form factor of the open source software applications delivered by Tanzu Application Catalog?
Tanzu Application Catalog delivers open source software in the form of container images, Helm charts and Virtual machines. You get the option to choose the form factor you need.
Where can I deploy the applications I get from Tanzu Application Catalog?
Applications from Tanzu Application Catalog are platform-agnostic and can be deployed on any OCI-compliant Kubernetes environments, on any OCI-compliant container runtime and as VMs on VMware infrastructure. We test the applications in our catalog across all major Kubernetes platforms including Tanzu Kubernetes Grid, Google Kubernetes Engine, Amazon Elastic Container Service, Azure Kubernetes Service and Red Hat OpenShift, so that you can confidently deploy them on any platform of your choice. View our verification matrix
How does Tanzu Application Catalog ensure that its containers and Helm charts do not include fixable CVEs?
To ensure that all Tanzu Application Catalog images include the latest security fixes, Tanzu Application Catalog implements the following policies:
- Tanzu Application Catalog triggers a release of a new Helm chart when a new version of the main server or application is detected. For example, if the system automatically detects a new version of MariaDB, the Tanzu Application Catalog pipeline automatically releases a new container with that version and also releases the corresponding Helm chart if it passes all tests. That way, Tanzu Application Catalog ensures that the application version released is always the latest stable one and has the latest security fixes.
- Tanzu Application Catalog triggers a release of a new chart when a package that includes a fix for a CVE from the distribution in any of the containers that it includes is detected. The system scans all our containers and releases new images daily with the latest available system packages. Once the pipeline detects there is a new package that fixes a CVE, our team triggers the release of a new Helm chart to point to the latest container images.
- The Tanzu Application Catalog team monitors different CVE feeds—such as Heartbleed or Shellshock—to fix the most critical issues as soon as possible. Once a critical issue is detected in any of the catalog charts included in Tanzu Application Catalog, a new solution is released. Tanzu Application Catalog provides updates in less than 48 business hours.
How frequently are the applications in Tanzu Application Catalog verified and updated?
All container images, Helm charts and virtual machines available in the catalog are continuously verified to ensure they include the latest dependencies and minimal CVEs. New versions are only released after they meet specific conditions. This ensures that only relevant updates are delivered to customer registries.
Container images
A new container is triggered as long it fulfills any of the following cases:
- A fix for a critical CVE is detected in the OS package
- An upstream update in the main component of the container is detected
- There are changes in the configuration scripts such as feature improvements or bug fixes
- Every 30 days if a new version of the container was not released within that period
Helm charts
A new Helm chart is triggered as long as it fulfills any of the following cases:
- A new Helm chart is released in Tanzu Application Catalog
- A new feature or fix for an existing application is merged to the catalog
- A new version of the main container is triggered that fixes a critical CVE
- Indirectly when there is an upstream update in the main container
- Every 30 days if a new version of the chart was not released within that period
Virtual machines
A new VM is triggered as long it fulfills any of the following cases:
- An upstream update in the main component of the VM is detected
- A critical security fix is available
- Every 30 days if a new version of the application was not released within that period
I have been using the open source Bitnami packages for years now. Why should I upgrade to Tanzu Application Catalog?
We recommend the open source Bitnami packages for development and UAT environment use cases. If you are from an enterprise software development team, Tanzu Application Catalog allows you to use open source software application components in mission-critical projects and production environments in a secure, sustainable and compliant manner. The following are some of the key benefits you can enjoy by upgrading to Tanzu Application Catalog:
- Strict service level objective commitments—both in update releases and support
- Options to customize open source software at base OS, language runtime and application levels
- Comprehensive metadata including SPDX-standard SBoM, VEX documentation and CVE scan reports
- Private delivery to your own OCI-compliant registry of choice
- Access to SLSA Level 3-compliant open source software