Table of contents of the article:
The dominant position that Red Hat Enterprise Linux (RHEL) occupies in the enterprise market is not an accident or a sudden explosion. It is the result of a strategy that has its roots in the past, when Red Hat revolutionized the open-source ecosystem in 2002 by introducing a subscription-based business model. That move not only answered the crucial question — “How do you make money with free software?” — but also defined the contours of a new paradigm: the value of professional support, certification, stability and security in mission-critical contexts.
Since then, RHEL has established itself as the de facto standard in the enterprise world., becoming not only a technical but also a political and strategic reference. Its acquisition by IBM in 2019 further strengthened this position, but also marked the beginning of a new phase, more aggressive and less accommodating towards the open-source community.
The turning point with CentOS and the birth of clones
December 2020 marked a turning point in the enterprise Linux ecosystem. With a official announcement, Red Hat announced the end of development of the traditional branch of CentOS Linux, the one stable and binary compatible with RHEL, announcing the definitive transition to CentOS Stream, a rolling release intended as a preview of future releases of Red Hat Enterprise Linux.
This decision, which came without significant warning, generated a lot of discontent in the community. Thousands of companies, hosting providers and system integrators who had adopted CentOS as a free but solid platform for production environments, suddenly found themselves without a clear path for the continuity of their infrastructures.
Since then, the void left by CentOS has given birth — or new life — to a series of alternative projects, with the explicit aim of recreating a distribution 1:1 compatible with RHEL, but free from commercial constraints.
Among the main protagonists that emerged:
-
SoulLinux, sponsored by CloudLinux, a company with long experience in supporting shared hosting environments and hardened Linux servers.
-
Rocky linux, promoted by Ctrl IQ (Ctrl IQ), founded by Gregory Kurtzer, the original co-founder of CentOS.
Both projects are currently proposed as Enterprise Linux Distribution fully compatible with RHEL at the binary level, but with open, community-driven and transparency-oriented governance models.
The promise is clear: to guarantee reliable and sustainable continuity to all those users and companies that had chosen CentOS for its technical features and reliability, but who do not want — or cannot — submit to Red Hat's commercial model.
But being a clone is no longer enough
In today’s context, however, simply replicating the binary structure of RHEL is not enough. The market requires much more: transparent governance, infrastructure robustness, credible roadmaps and, above all, security and compliance guarantees.
That is why projects like AlmaLinux and Rocky Linux are trying to distinguish themselves through specific initiatives, which aim to bring their level to the standard required by the most demanding organizations.
AlmaLinux: Security Certified by the US Department of Defense
One of the most significant steps came in February 2025, when the AlmaLinux team announced the STIG certification, officially published by Defense Information Systems Agency (DISA), an agency within the United States Department of Defense.
Lo STIG (Security Technical Implementation Guide) is a rigorous set of instructions that indicate how to configure an operating system in a secure way, according to standards recognized at military level. This result, the fruit of work started in August 2023, places AlmaLinux among the very few distributions to have an official STIG: the others are Red Hat Enterprise Linux, Oracle Linux, SUSE Linux Enterprise and Ubuntu.
For an enterprise operating system, getting this certification means joining a very exclusive club. It's a clear signal to those who need to implement stringent security policies: AlmaLinux is not just a clone, it's also a solid option for government, banking, and highly regulated environments.
Rocky Linux: Hardened and open-source governance
Rocky Linux continues to solidify its position in the enterprise distribution landscape, distinguishing itself through targeted initiatives in both security and open-source governance.
Rocky Linux from CIQ – Hardened: Enhanced Security
Recently, CIQ introduced an advanced variant of the distribution, called Rocky Linux from CIQ – Hardened. This version is designed to meet the needs of high security environments, offering:
-
System Level Hardening: Reduces risks associated with zero-day and CVE vulnerabilities by eliminating potential attack surfaces and common exploit vectors.
-
Rapid Risk Mitigation: Address security threats promptly, significantly reducing time to exposure.
-
Advanced Access Controls: Implement strict authentication policies and strengthened access control mechanisms.
-
Advanced Threat Detection: Use tools like the Linux Kernel Runtime Guard (LKRG) to detect sophisticated intrusions that might elude traditional security systems.
-
Simplified Distribution: Provides pre-configured and pre-hardened systems, saving time and resources in security configurations.
These features make Rocky Linux from CIQ – Hardened particularly suitable for sectors such as fintech, healthcare and public administration, where security is of primary importance. According to Gregory Kurtzer, CEO of CIQ, this initiative addresses the concerns of many IT executives regarding the protection of their critical infrastructure, offering a more secure foundation while maintaining compatibility with Enterprise Linux standards.
In addition to the advances in safety, the Rocky Enterprise Software Foundation (RESF) has officially signed the United Nations Open Source Principles. These principles provide guidelines to promote collaboration and adoption of open source technologies globally. RESF's membership underscores Rocky Linux's commitment to transparent governance and an inclusive community, strengthening user confidence in the distribution.
Through these initiatives, Rocky Linux not only provides a stable and secure platform for enterprises, but also promotes the values of openness and collaboration that are fundamental to the advancement of free software.
But is there room for everyone?
The landscape of RHEL “clones” has expanded rapidly. In addition to AlmaLinux and Rocky Linux, giants like SUSE and Canonical are not standing still. SUSE has launched its own alternative with SUSE Liberty Linux Lite, a project that aims to provide commercial support for mixed and RHEL-derived environments. Canonical continues to strengthen Ubuntu's presence in the enterprise sector, focusing on security certifications and cloud-native solutions.
In this scenario, the actual economic sustainability of open-source clones will be put to the test. For years, CentOS has represented a “free but reliable” alternative for thousands of companies. But today the paradigm has changed: zero cost is no longer sufficient if not accompanied by services, support and real guarantees.
Conclusions: the future of clones depends on quality, not compatibility
Today it is no longer enough to declare oneself binary compatible with RHEL. If until a few years ago it was enough to guarantee compatibility at the package level to be considered a valid alternative, the enterprise market has raised the bar over time, requiring quality standards that go well beyond simple binary alignment.
The future of Red Hat clones therefore passes through the ability to offer a complete set of guarantees, tools and services that respond to the real needs of companies. Specifically, we are talking about:
-
Institutionally recognized security certifications, such as the US Department of Defense STIGs, Federal Information Processing Standards (FIPS) certifications or Common Criteria. These are not “nice to haves”, but fundamental requirements for those who operate in regulated sectors such as defense, fintech, healthcare or public administration. Having a distribution compliant with these standards means being able to enter highly selective tenders and environments.
-
Professional support with clear and credible SLAs, able to guarantee response times, problem resolution, timely updates and 24/XNUMX availability. Technical support cannot be improvised or left to the goodwill of the community: companies want rapid responses, defined escalations, ticket traceability and the certainty that behind a distribution there is a structured organization.
-
Transparent and community-oriented governance, which does not depend exclusively on a commercial entity, but which truly involves developers, users and partners in the decision-making process. Trust in the roadmap, open lifecycle management (EOL, backports, security patches) and design consistency are elements that strongly influence the perception of reliability.
-
Trusted Ecosystems for Complex Production Environments, including stable repositories, consistent toolchains, comprehensive documentation, centralized management tools (such as Satellite or Landscape), automation (Ansible, Terraform), containerization (Podman, OpenShift compatible), and support for hybrid and cloud-native infrastructures.
Red Hat has built a perfect machine over twenty years: not just a Linux distribution, but an entire enterprise ecosystem, with integrated software lifecycle tools, strategic relationships with hardware and software partners, long-term support, and a decisive influence on the evolution of the Linux kernel and standards.
Clones can certainly fill some of the technical gap by replicating repositories, packages, and configurations, but to truly compete in the enterprise market, they must invest in what turns an operating system into a trusted platform.
And trust is, ultimately, the most difficult asset to build: it cannot be downloaded from GitHub, nor can it be obtained with a simple rpmbuild.
Trust is earned over time, with competence, transparency and consistency.
