Docker Licensing Explained: Subscription Tiers, Desktop Rules and Hub Limits
This page answers the Docker licensing questions buyers actually ask — who needs to pay for Docker Desktop, what is still free, why CI keeps failing on Docker Hub pull limits, and where Docker’s compliance terms have real teeth. Figures are Docker list prices in USD.
The short answer: Docker Desktop is free only for organisations with fewer than 250 employees and less than $10 million in annual revenue — you must be under both. Government entities get no free use at any size. But Docker Engine and the CLI on Linux remain open source and free, which is the legitimate remediation path for a lot of estates. The compliance exposure is real: Docker can inspect on ten days’ notice and invoice retroactively.
What do Docker’s subscription tiers cost?
| Tier | Annual (per user/mo) | Monthly (per user/mo) | User cap |
|---|---|---|---|
| Personal | $0 | $0 | 1 |
| Pro | $9 | $11 | 1 |
| Team | $15 | $16 | Up to 100 |
| Business | $24 | $24 | No cap |
Business is the only tier with no annual discount. These prices date from Docker’s November 2024 repackaging, which folded Desktop, Hub, Build Cloud, Scout and Testcontainers Cloud into a single per-user subscription.
Minimum order quantity catches smaller teams out. On a new annual contract, Docker requires a minimum purchase of 25 seats, with 10-seat minimum increments for existing customers — and that applies through resellers and marketplaces too. A 12-person team that crosses the free-use threshold still buys 25 seats. Self-serve credit card purchases are exempt.
Who actually has to pay for Docker Desktop?
Docker’s subscription agreement restricts free Desktop use to non-commercial open source projects, or a commercial undertaking with fewer than 250 employees and less than US $10,000,000 in annual revenue. The conditions are conjunctive — you must be under both to qualify. Crossing either threshold triggers the paid requirement.
Two things people get wrong here, consistently:
- It is not 250 developers, it is 250 employees. A 400-person company with 30 developers is over the threshold. But you do not then buy 400 seats — you buy seats for the people authorised to use Docker Desktop. The threshold is an eligibility test, not a seat count.
- Government entities have no free tier at all. Docker’s terms carve them out with no size threshold. A five-person government body still needs paid seats.
What is still free?
Docker Engine, the Docker CLI and Moby on Linux remain open source and free. Docker’s own documentation states the licensing and distribution terms for those projects are not changing. The licence attaches to Docker Desktop — the application — not to the container runtime.
That distinction is the legitimate remediation path for most over-threshold organisations: developers who run Docker Engine and the CLI directly on Linux, or in a Linux VM, or on a CI runner, need no Docker subscription. Personal use, education and non-commercial open source projects are also free regardless of employer size.
Docker Desktop for Linux is still Docker Desktop. It is the licensed application, not the free Engine. This is probably the single most common misreading of Docker’s terms we see, and it is an expensive one to get wrong in an audit.
Why does our CI keep failing on Docker Hub pull limits?
| User type | Pull rate limit |
|---|---|
| Unauthenticated | 100 per 6 hours, per IPv4 address or IPv6 /64 subnet |
| Personal (authenticated) | 200 per 6 hours |
| Pro, Team, Business | Unlimited, subject to fair use |
The failure mode is almost always the same. Shared CI runners — hosted GitHub Actions runners, GitLab shared runners, a Kubernetes node pool behind one NAT egress IP — pull unauthenticated by default and collectively burn through the 100-per-6-hours bucket attributed to that IP. You get HTTP 429 and TOOMANYREQUESTS, surfacing in Kubernetes as ImagePullBackOff.
Authenticating the pull moves attribution from the shared IP to your account, which fixes it in most cases. A pull-through registry mirror is the more robust answer, because even authenticated users sharing a CI platform’s egress IP can still trip Docker’s separate abuse rate limit.
Docker’s own pages contradict each other on this. The pricing page and pricing FAQ still quote the rate limits Docker announced in late 2024 and then abandoned in February 2025 — figures like “10 pulls/hour” that were never enforced. The documentation figures above are the current ones. If someone quotes you a per-hour pull limit from Docker’s marketing pages, check it against the docs.
Worth knowing for budgeting: Docker cancelled pull-based consumption charges outright in 2025 and delayed storage billing indefinitely, with a public commitment to give at least six months’ notice before any future enforcement.
What do you have to buy Business for?
Everything governance-related. Team gets you audit logs, role-based access control and unlimited Scout-enabled repositories. Business is where security and identity live:
| Capability | Personal | Pro | Team | Business |
|---|---|---|---|---|
| Private Hub repositories | 1 | Unlimited | Unlimited | Unlimited |
| Build Cloud minutes/mo | Trial | 200 | 500 | 1,500 |
| Audit logs, Hub RBAC | — | — | Yes | Yes |
| SSO / SAML | — | — | — | Yes |
| SCIM provisioning | — | — | — | Yes |
| Image & Registry Access Management | — | — | — | Yes |
| Hardened Docker Desktop, ECI | — | — | — | Yes |
| Support response SLA | — | 5 business days | 2 business days | 1 business day |
Registry Access Management only works if sign-in is enforced. Docker’s documentation is explicit that it takes effect only when users are signed in with organisation credentials — a developer who signs out bypasses it. Enforcing sign-in across a fleet is an MDM deployment project, not a checkbox. If you are buying Business specifically for RAM or Image Access Management, budget for that work or the control does not exist.
Where Docker contracts catch buyers out
You pay for who is authorised, not who logged in
Docker’s FAQ is unambiguous: all users authorised to access the products in a paid plan require a paid subscription, and you pay for the total number of authorised users. You get flexibility to swap which individuals occupy the seats, but the count is authorisation, not activity. Teams that budget from last month’s active-user report will be short.
Contractors and consultants consume seats
The subscription agreement expressly includes employees, consultants, contractors and agents of the customer and its affiliates within the definition of User. There is no contractor exemption.
Seat changes are asymmetric
Adding seats mid-cycle is prorated and charged immediately. Removing seats takes effect only at the next billing cycle, and unused portions are not refundable. Over-provisioning is expensive to unwind, so start tight and add.
The audit clause has real teeth
Docker may inspect your records on ten days’ notice, and if the records — yours or Docker’s own service telemetry — show excess use, Docker may invoice for past and ongoing underpaid amounts, payable promptly. No cure period or cap is stated, and remedies are expressly non-exclusive.
The self-identification risk is the part people underestimate. If your developers signed into Docker Desktop with company email addresses, Docker can build the case from its own data without ever asking for yours.
AI agents can now count as Users
Docker’s subscription agreement effective August 2026 extends the definition: for AI Features, “User” means a human or AI Agent. The metering mechanics are not published. If you are deploying agentic tooling against Docker’s platform, get the billing basis in writing.
Air-gapped environments are an open question
Docker Desktop licence verification requires online authentication, and Docker’s own public roadmap issue on offline licence verification has been open since 2024 with no documented workaround. For classified, OT or air-gapped environments, make this a pre-contract question rather than a post-deployment discovery.
Frequently asked questions
We have 400 employees but only 30 developers — do we need 400 seats?
No. Seats are per authorised user of the Docker products, not per employee. The 250-employee and $10M revenue figures are the eligibility test for free use, not a seat count. You buy seats for the people authorised to use Docker Desktop — subject to the 25-seat minimum on new annual contracts.
Can we avoid licensing entirely by using Docker Engine on Linux?
For Docker Engine, the CLI and Moby, yes — they remain open source and free. Not if developers run Docker Desktop, including Docker Desktop for Linux. This is a legitimate and common remediation path, and for CI runners and server-side workloads it is usually the right architecture anyway.
Is the threshold 250 employees OR $10M, or AND?
To qualify for free use you must be under both. Crossing either one triggers the paid requirement.
Is the licence per person or per machine?
Per named individual. One developer can use their seat across multiple machines; two people cannot share one seat.
Are Docker Hardened Images included in our Business subscription?
No. DHI is a separate product line with its own tiers. Docker released a free Community catalogue of hardened images under Apache 2.0 in December 2025, with paid Enterprise tiers for CVE SLAs, compliance variants and extended lifecycle support.
Will Docker start charging for pulls or storage?
Pull consumption charges were cancelled in 2025. Storage billing is delayed indefinitely, with a commitment to announce any future enforcement at least six months in advance.
We think we have been non-compliant for a while. What now?
Do not wait for the ten-day notice. An assessment establishes what you actually owe, and there is usually a cheaper architecture available — moving CI and server workloads to Docker Engine, sizing Desktop seats to actual need, and buying at the right tier rather than the panicked one.
Pricing and licensing terms verified 19 September 2026 against Docker’s published pricing, subscription service agreement and product documentation. Docker’s marketing pages and documentation currently disagree on Hub rate limits — figures above follow the documentation. Confirm current terms before budgeting.
Not sure where you stand on Docker Desktop?
We run Docker compliance assessments and remediation — establishing real exposure, moving CI and server workloads onto Docker Engine where that is the right answer, and fixing registry pull limits properly with a pull-through mirror.
Speak With An Expert