Ping Identity Devops

Flex Images

Flex Images

Overview

Ping container images published with a -flex tag suffix represent a new generation of images designed to be more cloud-friendly, easier to operate, and better aligned with standard container practices.

Flex images are not drop-in replacements for current images. Current and flex images will coexist for an extended period so customers can adopt the new model deliberately, on their own timeline.

Background

As Ping moved its legacy products — such as PingFederate, PingDirectory, and PingAccess — into container-based operations, some patterns emerged that were useful early on but added complexity that impacted modern testing, staging, and production environments. Examples include:

  • Layered configuration behavior that makes it hard to accurately determine how a product is configured at runtime

  • Container lifecycle hook scripts rather than relying on the product to manage its own container behavior

  • Log handling that does not always align naturally with container platforms

Addressing these issues required improvements to both the products themselves and the design of the container images. For example, recent product versions can be configured through environment variables, reducing dependence on configuration files. The image design has been reworked accordingly as the internal V2 image effort.

What "flex" means

In this context, flex refers to the simplified operational model for the image itself — cleaner container behavior, clearer runtime expectations, and a design that better fits modern orchestration environments.

Improvements in flex images include:

  • Simplified image structure and runtime behavior

  • Reduced dependence on startup hooks and file manipulation at launch

  • Reduced or eliminated need for profile overlays to configure products

  • Reduced startup and restart times

  • Removal of non-critical components such as integration kits for some products

  • Simplified upgrade paths in container environments

What is changing

Customers will begin to see new images published with a -flex tag suffix on Docker Hub and other container registries, starting with PingFederate. For example:

pingidentity/pingfederate:13.0.3-alpine-flex

These images reflect the broader container direction for Ping products.

What is not changing

Current images will continue to have the same release cycle with the same tags they have had to this point, using a primary YYMM tag (for example, 2608). Existing automation and workflows using these images will continue to operate unchanged even as the new flex images arrive.

See Using Release Tags for tag format details.

Migration

Flex images are not a drop-in replacement. Plan for a deliberate migration rather than a tag swap. More detailed guidance will be published as the rollout continues, covering:

  • Product-specific deployment and configuration details for each flex image

  • Migration considerations and guides for moving from current to flex images per product

  • Helm and Kubernetes usage patterns and examples

  • Known limitations and support expectations

Ping encourages moving to flex images to gain improved efficiency, operational simplicity, and better alignment with product support lifecycles. Timing is at your discretion; both image lines are supported during the transition.

Image signatures

Flex images are signed with Cosign using the same KMS-backed key as current images. See Image Signature Verification for verification steps.