<a id="image-reference"></a>

# Docker Image Reference for Confluent Platform

Confluent Platform Docker images are published on [Docker Hub](https://hub.docker.com/u/confluentinc/) and include the canonical
images `cp-kafka` for Apache Kafka®, `cp-server` for Confluent Server with RBAC and
Tiered Storage, `cp-schema-registry`, `cp-kafka-connect`,
`cp-ksqldb-server`, and `cp-kafka-rest`. The source files are in
the linked GitHub repos so you can extend and rebuild the images. To
configure these images, see [Docker Image Configuration Reference for Confluent Platform](config-reference.md#config-reference).

The following sections list the available images and the Confluent software
packages that they contain. Images that require the Confluent Enterprise License include proprietary
components and must be licensed when deployed.

<a id="docker-image-retention"></a>

## Docker image retention policy

To ensure the security and performance of the Confluent registry, Confluent removes Docker images for
end-of-life (EOL) versions from public access.

Confluent recommends upgrading regularly to newer versions of supported images for improved performance,
security, and user experience. If you use legacy versions, migrate to a supported release to avoid
disruptions.

## Image guide

The following sections list images by component type. In most cases, the license is noted for each package. For more information about package licenses, see [Manage Confluent Platform Licenses](../license.md#cp-license-overview).

### Base images

The following images provide build files for the Confluent Platform images. The license
varies by package. All Confluent Platform images use a Red Hat UBI 9 base, replacing UBI 8.

#### NOTE
Confluent deprecates `cp-base-new` and `cp-base-lite` as of Confluent Platform version 8.3.0
and plans to remove them in Confluent Platform version 8.4.0. If you build custom images on
top of `cp-base-new` or `cp-base-lite`, you must migrate to `cp-base-java-micro`,
or to `cp-base-java` if you require the additional `ubi9-minimal` utilities.

For the Java runtime, starting with version 8.3.0, Confluent Platform base Docker images use
Eclipse Temurin 25, which is the latest long-term support release. This upgrade
follows the addition of Java Development Kit (JDK) 25 support in Kafka 4.2. In
Confluent Platform 8.0.x through 8.2.x, the `cp-base-java` and `cp-base-new` images ship
with Temurin 21, and the `cp-base-lite` image ships with Temurin 17. For
details about Java version support across Confluent Platform releases, see
[Java](../versions-interoperability.md#java-sys-req).

Starting with version 8.3.0, Confluent Platform also includes `cp-base-java-micro`, which
is an ultra-lightweight base image built on the Red Hat `ubi9-micro` base
rather than the `ubi9-minimal` base used for `cp-base-java`. This
image ships a minimal set of packages for the smallest footprint of the
Confluent Platform base images.

Because it is built on `ubi9-micro`, `cp-base-java-micro` does not include
a package manager such as `dnf` or `microdnf`. To add packages on top of it,
you must use a multi-stage Dockerfile. Install the packages into a directory in
a `ubi9` builder stage, for example by running
`dnf install -y --installroot=/microdir ...`, and then copy them into the
final `cp-base-java-micro` stage by using `COPY --from` instruction. For a
complete example, see the [cp-ksqldb-server Dockerfile](https://github.com/confluentinc/ksql-images/blob/8.3.x/cp-ksqldb-server/Dockerfile.ubi9).

Starting with version 8.1.0, all Confluent Platform Docker images use the minimal
`cp-base-java` base image, which Confluent first introduced for
`cp-ksqldb-server` in version 8.0.0. This image reduces deployment size and
security attack surface by replacing the full JDK with the Java Runtime
Environment (JRE) and removing many common packages, including `python`,
`git`, `tar`, and `wget`. This change results in a size reduction of up
to 60% for Confluent Platform Docker images. If your operations, debugging procedures, or
custom Dockerfiles rely on any of these removed packages, install them
manually by running `microdnf install -y <package-name>`.

| Image Name                                                                                      | Packages                                                                                                         | GitHub Repo                                                    |
|-------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------|
| [cp-base-java](https://github.com/confluentinc/common-docker/tree/master/base-java)             | - temurin-25-jre<br/>- hostname<br/>- crypto-policies-scripts<br/>- findutils                                    | [common-docker](https://github.com/confluentinc/common-docker) |
| [cp-base-java-micro](https://github.com/confluentinc/common-docker/tree/master/base-java-micro) | - temurin-25-jre<br/>- procps-ng<br/>- crypto-policies-scripts<br/>- findutils<br/>- hostname<br/>- shadow-utils | [common-docker](https://github.com/confluentinc/common-docker) |
| [cp-base-lite](https://github.com/confluentinc/common-docker/tree/master/base-lite)             | - temurin-25-jre<br/>- curl                                                                                      | [common-docker](https://github.com/confluentinc/common-docker) |
| [cp-base-new](https://hub.docker.com/r/confluentinc/cp-base-new)                                | - temurin-25-jdk<br/>- wget<br/>- openSSL<br/>- python39<br/>- additional utilities not<br/>  listed             | [common-docker](https://github.com/confluentinc/common-docker) |

<a id="ak-images"></a>

### Kafka images

The following images contain Apache Kafka®.

- [cp-kafka](https://hub.docker.com/r/confluentinc/cp-kafka) is the Confluent official Docker image for Kafka and includes the Community Version of Kafka.
- [confluent-local](https://hub.docker.com/r/confluentinc/confluent-local) is a Kafka package optimized for local development.
  This Docker image enables you to start Kafka in KRaft mode with no configuration.
- The [Confluent Server image](#cp-server-image) package listed in the next section includes everything in [cp-kafka](https://hub.docker.com/r/confluentinc/cp-kafka) and additional commercial features
  that are only available as a part of the cp-server package.

| Image Name                                                               | Packages Included (License)                                                                                                                                                                           | GitHub Repo                                                  |
|--------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------|
| [cp-kafka](https://hub.docker.com/r/confluentinc/cp-kafka)               | - confluent-kafka ([Apache 2 License](https://www.apache.org/licenses/LICENSE-2.0))                                                                                                                   | [kafka-images](https://github.com/confluentinc/kafka-images) |
| [confluent-local](https://hub.docker.com/r/confluentinc/confluent-local) | - confluent-kafka ([Apache 2 License](https://www.apache.org/licenses/LICENSE-2.0))<br/>- confluent-kafka-rest ([Confluent Community License](https://www.confluent.io/confluent-community-license/)) | [kafka-images](https://github.com/confluentinc/kafka-images) |

<a id="cp-server-image"></a>

### Confluent Server image

Confluent Server is a component of Confluent Platform that includes everything in the [cp-kafka](#ak-images) package
and additional commercial features that are only available as a part of the `cp-server` package.
Following are a few key features included in Confluent Server:

- Role-based access control (RBAC).
- Tiered Storage.
- Self-Balancing Clusters.

For the full list of Confluent Server features, see [Enterprise license subscription](../license.md#cp-enterprise-subs-license).

| Image Name                                                   | Packages Included (License)                                                                                                                    | GitHub Repo                                                  |
|--------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------|
| [cp-server](https://hub.docker.com/r/confluentinc/cp-server) | - cp-server (Confluent Enterprise License)<br/>- cp-security (Confluent Enterprise License)<br/>- cp-rebalancer (Confluent Enterprise License) | [kafka-images](https://github.com/confluentinc/kafka-images) |

### Schema Registry image

The `cp-schema-registry` image includes Schema Registry, telemetry, and security
plugins. Schema Registry provides a centralized repository for managing and
validating schemas for topic message data.

| Image Name                                                                     | Packages Included (License)                                                                                                                                                                                                                                                                                                                                                      | GitHub Repo                                                                      |
|--------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------|
| [cp-schema-registry](https://hub.docker.com/r/confluentinc/cp-schema-registry) | - confluent-schema-registry ([Confluent Community License](https://www.confluent.io/confluent-community-license/))<br/>- confluent-telemetry (Confluent Enterprise License)<br/>- confluent-security (Confluent Enterprise License)<br/>- confluent-schema-registry-security-plugin (Confluent Enterprise License)<br/>- confluent-control-center (Confluent Enterprise License) | [schema-registry-images](https://github.com/confluentinc/schema-registry-images) |

### Connect images

Connect is part of Kafka and is used to integrate external systems with Kafka.

- `cp-server-connect` and the `cp-server-connect-base` images, which pull from [cp-server](#cp-server-image), are identical.
- `cp-kafka-connect` and the `cp-kafka-connect-base` images, which pull from [cp-kafka](#ak-images), are also identical.

These images had differences in the past.

#### NOTE
Starting with Confluent Platform version 8.3.0, the `cp-server-connect-base` and `cp-kafka-connect-base` Docker images are
deprecated and are scheduled for removal in Confluent Platform version 8.4.0. These base images are functionally identical to
`cp-server-connect` and `cp-kafka-connect`. If you build custom images on top of
`cp-server-connect-base` or `cp-kafka-connect-base`, migrate to `cp-server-connect` or
`cp-kafka-connect` respectively.

| Image Name                                                                                                                                                                  | Packages Included (License)                                                                                                                                                   | GitHub Repo                                                  |
|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------|
| [cp-kafka-connect](https://hub.docker.com/r/confluentinc/cp-kafka-connect) and<br/>[cp-kafka-connect-base](https://hub.docker.com/r/confluentinc/cp-kafka-connect-base)     | - confluent-schema-registry  ([Confluent Community License](https://www.confluent.io/confluent-community-license/))<br/>- confluent-hub-client (Confluent Enterprise License) | [kafka-images](https://github.com/confluentinc/kafka-images) |
| [cp-server-connect](https://hub.docker.com/r/confluentinc/cp-server-connect) and<br/>[cp-server-connect-base](https://hub.docker.com/r/confluentinc/cp-server-connect-base) | - confluent-schema-registry ([Confluent Community License](https://www.confluent.io/confluent-community-license/))<br/>- confluent-hub-client (Confluent Enterprise License)  | [kafka-images](https://github.com/confluentinc/kafka-images) |

### ksqlDB image

ksqlDB enables you to build event streaming applications using your familiarity with relational databases.

| Component                    | Image Name                                                                 | Packages Included (License)                                                                                                                                                                                                                                                                                                                                                      | GitHub Repo                                                |
|------------------------------|----------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------|
| ksqlDB Server<br/>ksqlDB CLI | [cp-ksqldb-server](https://hub.docker.com/r/confluentinc/cp-ksqldb-server) | - ksql-cli ([Confluent Community License](https://www.confluent.io/confluent-community-license/))<br/>- ksqldb-server ([Confluent Community License](https://www.confluent.io/confluent-community-license/))<br/>- confluent-telemetry (Confluent Enterprise License)<br/>- confluent-hub (Confluent Enterprise License)<br/>- confluent-security (Confluent Enterprise License) | [ksql-images](https://github.com/confluentinc/ksql-images) |

### REST Proxy image

REST Proxy provides a RESTful interface to an Kafka cluster, enabling you to produce and consume messages, view the state of
the cluster, and perform administrative actions without using the native Kafka protocol or clients.

| Image Name                                                           | Packages Included (License)                                                                                                                                                                                                         | GitHub Repo                                                            |
|----------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------|
| [cp-kafka-rest](https://hub.docker.com/r/confluentinc/cp-kafka-rest) | - confluent-kafka-rest ([Confluent Community License](https://www.confluent.io/confluent-community-license/))<br/>- confluent-control-center (Confluent Enterprise License)<br/>- confluent-security (Confluent Enterprise License) | [kafka-rest-images](https://github.com/confluentinc/kafka-rest-images) |

### Confluent CLI image

The Confluent CLI (CLI) enables developers to manage both
Confluent Cloud and Confluent Platform and is source-available under the Confluent Community License.

| Image Name                                                           | Packages Included (License)                                                                            | GitHub Repo                                |
|----------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------|--------------------------------------------|
| [confluent-cli](https://hub.docker.com/r/confluentinc/confluent-cli) | - confluent-cli ([Confluent Community License](https://www.confluent.io/confluent-community-license/)) | [cli](https://github.com/confluentinc/cli) |

### Control Center image

Control Center is a self-hosted web-based tool for managing and monitoring key components of Confluent Platform.

| Image Name                                                                                                           | Packages Included/License                                 | GitHub Repo                                                                                      |
|----------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------|--------------------------------------------------------------------------------------------------|
| [cp-enterprise-control-center-next-gen](https://hub.docker.com/r/confluentinc/cp-enterprise-control-center-next-gen) | - confluent-control-center (Confluent Enterprise License) | [control-center-next-gen-images](https://github.com/confluentinc/control-center-next-gen-images) |

### Confluent Private Cloud Gateway image

Confluent Private Cloud Gateway is a stateless, self-managed, Kafka protocol-aware gateway that acts as an intelligent routing layer between clients and Kafka clusters.

| Image Name                                                       | Packages Included/License         | GitHub Repo                                                      |
|------------------------------------------------------------------|-----------------------------------|------------------------------------------------------------------|
| [cpc-gateway](https://hub.docker.com/r/confluentinc/cpc-gateway) | - Confluent Private Cloud license | [gateway-images](https://github.com/confluentinc/gateway-images) |

### Confluent Cloud Gateway image

Confluent Cloud Gateway is a cloud-native Kafka proxy solution designed to simplify client connectivity, secure access, and manage clusters across distributed Kafka environments.

| Image Name                                                                                       | Packages Included/License   | GitHub Repo                                                                                              |
|--------------------------------------------------------------------------------------------------|-----------------------------|----------------------------------------------------------------------------------------------------------|
| [confluent-gateway-for-cloud](https://hub.docker.com/r/confluentinc/confluent-gateway-for-cloud) | - Gateway Add-On license    | [gateway-images](https://github.com/confluentinc/gateway-images/tree/master/confluent-gateway-for-cloud) |

<a id="kcat-docker-image"></a>

### kcat utility image

kcat is a command-line utility that you can use to test and debug Kafka deployments.

| Image Name                                               | Packages Included (License)                                                                        | GitHub Repo                                                        |
|----------------------------------------------------------|----------------------------------------------------------------------------------------------------|--------------------------------------------------------------------|
| [cp-kcat](https://hub.docker.com/r/confluentinc/cp-kcat) | - kafkacat ([Apache Kafka C Driver License](https://github.com/edenhill/kcat/blob/master/LICENSE)) | [kafkacat-images](https://github.com/confluentinc/kafkacat-images) |

### MQTT Proxy image

MQTT Proxy provides a scalable and lightweight interface that enables
MQTT clients to produce messages to Kafka directly, in a Kafka-native way, that avoids redundant replication and increased lag.

| Image Name                                                           | Packages Included (License)                           | GitHub Repo                                                            |
|----------------------------------------------------------------------|-------------------------------------------------------|------------------------------------------------------------------------|
| [cp-kafka-mqtt](https://hub.docker.com/r/confluentinc/cp-kafka-mqtt) | - confluent-kafka-mqtt (Confluent Enterprise License) | [kafka-mqtt-images](https://github.com/confluentinc/kafka-mqtt-images) |

### Replicator images

Replicator enables you to reliably replicate topics from one Kafka cluster to another.

| Component                 | Image Name                                                                                                       | Packages Included (License)                                 | GitHub Repo                                                                        |
|---------------------------|------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------|------------------------------------------------------------------------------------|
| Replicator                | [cp-enterprise-replicator](https://hub.docker.com/r/confluentinc/cp-enterprise-replicator)                       | - confluent-kafka-replicator (Confluent Enterprise License) | [kafka-replicator-images](https://github.com/confluentinc/kafka-replicator-images) |
| Replicator<br/>Executable | [cp-enterprise-replicator-executable](https://hub.docker.com/r/confluentinc/cp-enterprise-replicator-executable) | - confluent-kafka-replicator (Confluent Enterprise License) | [kafka-replicator-images](https://github.com/confluentinc/kafka-replicator-images) |

### Confluent for Kubernetes image

Confluent for Kubernetes allows you to deploy and manage Confluent Platform as a stateful container application on Kubernetes.

| Image Name                                                                     | License                                             | GitHub Repo   |
|--------------------------------------------------------------------------------|-----------------------------------------------------|---------------|
| [confluent-operator](https://hub.docker.com/r/confluentinc/confluent-operator) | - confluent-operator (Confluent Enterprise License) | Private       |

#### NOTE
You need to install the Confluent for Kubernetes image using Helm. For instructions, see [Deploy and Manage Confluent Platform Using Confluent for Kubernetes](https://docs.confluent.io/operator/current/overview.html).

## Confluent Platform image tags

The Confluent Platform Docker images are tagged as follows:

```text
<cp_version>-<image_release_number>-<os_type>.<processor_architecture>
```

`<image_release_number>` is incremented when an updated image needs to be
uploaded for the same `<cp-version>`.

For example, for the Confluent Platform 8.3.1 images with RHEL UBI 8 being the only
supported and default OS, the available RHEL UBI 8 `cp-base-new` image tags
are:

```text
8.3.1-1-ubi8.amd64
8.3.1.amd64
latest.amd64
8.3.1-1-ubi8
8.3.1
latest
8.3.1-1-ubi8.arm64
8.3.1.arm64
latest.arm64

Linux ARM64 Docker images can be used on Apple macOS with M1.
```

Additional tags are applied to the image of the default OS type:

- To identify the image as being the default image for a given release.
  ```text
  <cp_version>
  ```
- To identify the most recent version of the image of the default OS type.
  ```text
  latest
  ```

For the supported OS types in Confluent Platform 8.3, see [Supported Versions for
Confluent Docker Images](../versions-interoperability.md#docker-sys-req).

## Validate Docker image integrity

If you pull Confluent Platform images from an internal or private registry (for example, Artifactory), you can validate that the image is identical
to the official image on Docker Hub by comparing their SHA256 digests. This ensures the image was not corrupted or
altered during the mirroring process.

To validate an image, do the following:

1. Pull the official image from Docker Hub:
   ```text
   docker pull confluentinc/cp-server:<tag>
   ```
2. Inspect the official image to get its digest:
   ```text
   docker inspect confluentinc/cp-server:<tag> --format='{{.Id}}'
   ```

   The command returns the image’s SHA256 digest:
   ```text
   sha256:abc123def456...
   ```
3. Pull the image from your internal registry:
   ```text
   docker pull <registry_url>/confluentinc/cp-server:<tag>
   ```
4. Inspect the image from your internal registry to get its digest:
   ```text
   docker inspect <registry_url>/confluentinc/cp-server:<tag> --format='{{.Id}}'
   ```
5. Compare the two SHA256 digest values from the official and internal registries and check the comparison result:
   * Exact match: The images are identical. The integrity of the mirrored image has been verified.
   * Mismatch: The images are different. This could be due to mirroring errors, unintended updates, or manual modifications in your internal registry.
     Troubleshooting registry discrepancies is outside the scope of Confluent Support.

## Related content

- [Install Confluent Platform Using Docker](installation.md#cpdocker-intro)
- [Install Confluent Platform for Apache Flink](/cp-flink/current/installation/helm.html)
- [Docker Image Configuration Reference for Confluent Platform](config-reference.md#config-reference)