Rocky Linux: Enterprise Linux Ledger 2026 Scorecard

Part of the Enterprise Linux Ledger (edition 2026-10-16). How the scores work: methodology.

Snapshot

Type: community project with commercial editions from CIQ
Owner: Rocky Enterprise Software Foundation (RESF), chaired by Gregory Kurtzer, who is also CEO of CIQ, the main commercial backer
Licence: Free, open-source licences, no subscription; CIQ sells Rocky Linux from CIQ (RLC+, RLC Pro, RLC Pro Hardened, RLC Pro AI), prices not published
Latest release: 10.2 (2026-05-28) and 9.8 (2026-05-27); 10.0 shipped 2025-06-11, three weeks after RHEL 10.0
Support lifecycle: Follows RHEL majors; minor releases are not maintained once the next minor ships; no in-place major upgrade (fresh install recommended)
Next milestone: None published; minors follow RHEL by one to three weeks; Infrastructure v2 and the Secure Boot certificate transition are in progress
Support window: 10 years per major with no extension from the project: Rocky 8 to 2029-05-31, 9 to 2032-05-31, 10 to 2035-05-31 (endoflife.date; CIQ states a 10-year RLC Pro lifecycle)
Tier: RHEL rebuild
Archetype: Rebuild with one backer
Evidence grade: B. Release posts, the 10.2 release notes, the security repository and State of the Foundation posts, the RESF and CIQ pages and the 2023 sourcing statement were read from primary sources. Major end dates come from endoflife.date; CIQ edition features are vendor claims; the 2021 architecture baseline is background knowledge.

Scorecard

Dimension	Score	Direction
Capability today	68.5 / 100	higher is better
Momentum since end of 2022	+6.5 points (2021 to 2022: +0.0)	higher is better
Credibility	16.0 / 25	higher is better
Sustainability risk	12.5 / 25	lower is better
Technical lock-in	2.0 / 25	lower is better
Integrator fit	9.0 / 20	higher is better
AI leverage	4.0 / 20	higher is better
Ledger Index	59.1 / 100	balanced weights; see the methodology

Capability by domain, 2015 to today

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Domain (weight)	2015	2019	2022	Today
Lifecycle and upgrades (15)	n/a	n/a	3.5	3.5
Security and compliance (15)	n/a	n/a	3	3.5
Hardware and architectures (10)	n/a	n/a	3.5	4
Virtualization and cloud images (10)	n/a	n/a	3.5	4
Containers and Kubernetes host (10)	n/a	n/a	3.5	4
Software currency and packaging (10)	n/a	n/a	4	4
Fleet management and automation (10)	n/a	n/a	2	2
Storage and filesystems (5)	n/a	n/a	4	4
Enterprise integration and certifications (5)	n/a	n/a	2.5	2.5
AI and GPU readiness (10)	n/a	n/a	1.5	2.5
Total / 100	n/a	n/a	62.0	68.5

Year by year: 2021: 62.0 · 2022: 62.0 · 2023: 62.0 · 2024: 62.0 · 2025: 63.0 · 2026: 68.5

What moved the score

Year	Domain	Change	Points	Trigger
2025	Hardware and architectures	3.5 → 4	+1.0	10.1: development board images; RISC-V support announced 2025-05-21 (preview)
2026	AI and GPU readiness	1.5 → 2.5	+2.0	CIQ RLC+ with integrated NVIDIA and AMD drivers (vendor claim, launch date not published; half credit)
2026	Containers and Kubernetes host	3.5 → 4	+1.0	10.2: bootable container images from image builder
2026	Security and compliance	3 → 3.5	+1.5	Security repository (2026-05-14) ships urgent fixes before upstream; ML-KEM key exchange in 10.2
2026	Virtualization and cloud images	3.5 → 4	+1.0	10.2: image builder outputs bootable container images, disk images and stateless PXE images

Direction, 2023 to 2026

Each release item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

Date	Item	Theme	Driver
2023-06	Sourcing statement: RHEL code via UBI images, pay-per-use cloud instances and CentOS Stream; Red Hat's terms rejected	Licensing	M
2024-05	8.10: final Rocky 8 minor	Lifecycle	U
2025-05	RISC-V support announced	Hardware	V
2025-06	10.0 GA three weeks after RHEL 10.0, with the x86-64-v3 baseline	Lifecycle	U
2025-11	10.1 with development board images	Hardware	C
2026-05	Opt-in security repository for urgent fixes ahead of upstream (CopyFail, Dirty Frag)	Security	C
2026-05	10.2: ML-KEM in OpenSSH and libssh; image builder bootable container and PXE outputs	Virtualization and cloud	U
2026-06	Secure Boot CA and KEK transition plan with dual-signed shims	Security	U
2026-06	State of the Foundation: leadership restructure, Infrastructure v2, own hardware replaces donated servers	Governance	C
2026-10	CIQ lists RLC Pro AI with CUDA, PyTorch and vLLM (observed; launch date not published)	AI	V

Centre of gravity: Lifecycle (2), Hardware (2), Security (2)
Blind spots (no items): Containers, Packaging, Fleet management, Storage, Enterprise integration
Driver mix: Vision 20%, Customer need 30%, Market window 10%, Upstream 40%, Portfolio 0%
Idea-to-need index: 0.33 (0 = demand-pulled, 1 = thesis-pushed)

Credibility: 16.0 / 25

Criterion	Score	Basis
Cadence	4	Minors follow RHEL by one to three weeks (10.0 after 22 days, 10.2 after 9 days); rhythm kept, not published
Roadmap transparency	3	News posts and open build tooling; no written roadmap
Say-do	3	Security repository and 10.x shipped; RISC-V images announced in May 2025 without a verified GA; Infrastructure v2 pending
Velocity	2.5	Each release carries RHEL's changes; the project's own additions are small (security repository, board images)
Lifecycle stability	3.5	Ten-year majors, but no in-place major upgrade and minors unsupported once the next ships

Sustainability risk: 12.5 / 25 (lower is better)

Criterion	Score	Basis
Maintainer concentration	3.5	The 2026-06-10 letter names reliance on a few people and slow onboarding; CIQ is the dominant backer
Backer health	2.5	CIQ is private with no published finances; AWS, Google Cloud and Arm listed as sponsors
Licence-change risk	3	Depends on RHEL sources taken through UBI, cloud instances and CentOS Stream; Red Hat's 2023 terms are contested
Abandonment signs	1.5	Releases within weeks of RHEL through 2026; infrastructure being rehoused from donated Equinix hardware
Security response	2	Project errata plus the 2026 opt-in security repository for urgent fixes; CVE response times not published

Technical lock-in: 2.0 / 25 (lower is better)

Criterion	Score	Basis
Formats	0.5	RPM, qcow2, OCI; identical to RHEL
Export path	0.5	migrate2rocky converts in; moving to RHEL or another rebuild is a scripted switch or reinstall
Stack coupling	0	No management stack required
Hardware / cloud coupling	0.5	Any x86-64-v3 or arm64 server; images on the four large clouds
Skills and tooling coupling	0.5	RHEL skills transfer one to one

Integrator fit: 9.0 / 20

Criterion	Score	Basis
Partner programme openness	3	CIQ partner programme (terms not read); the community side is open
Multi-tenancy and self-service	0.5	No management product in the community edition
API and infrastructure-as-code	2.5	Standard EL tooling: Ansible, community Terraform, web console API
Skills and certification	3	RHEL certifications apply in practice; no certification of its own

AI leverage: 4.0 / 20

How the product uses AI, scored per year like capability. Only GA counts.

Criterion	2019	2022	Today	Latest step
AI workload support	n/a	1	2	2026: CIQ RLC+ ships NVIDIA and AMD data centre drivers integrated (vendor claim, undated)
AI platform stack	n/a	0	1	2026: CIQ RLC Pro AI listed with CUDA, PyTorch and vLLM; availability not verified
AI-assisted operations	n/a	0	0	2021: None
Agent openness	n/a	1	1	2021: Web console API and Ansible; no agent interface

Year by year: 2021: 2 · 2022: 2 · 2023: 2 · 2024: 2 · 2025: 2 · 2026: 4

AI say-do, 2023 to 2026: 1 AI items announced; 0 GA, 0 still preview, 1 pending, 0 dropped. The one AI item is CIQ's RLC Pro AI, listed as a product with no launch date found.

The community edition carries no AI content of its own; GPU users install NVIDIA's repositories as on any EL system. CIQ's GPU-ready and AI editions are vendor claims without a verified launch date, so they count at half.

Reading

Rocky Linux delivers RHEL's capability for free within weeks of each release, which is why its capability line tracks RHEL's minus the vendor services. Its own additions are modest: a security repository, board images and a RISC-V announcement. The risk is organisational rather than technical: one commercial backer, a founder who chairs both the foundation and that backer, a sourcing model that depends on Red Hat's tolerance, and a 2026 letter that admits key-person reliance. A buyer should check whether the CIQ edition or a third-party contract covers the compliance items the community edition lacks.

Open questions and items to re-score

RISC-V general availability not verified; development board images shipped with 10.1.
CIQ RLC+, RLC Pro Hardened and RLC Pro AI: launch dates, prices and FIPS 140-3 certificates are vendor claims; the AI step counts at half.
Architectures at the 2021 start (ppc64le and s390x arrived later) rest on background knowledge, grade C.
Whether Red Hat enforces its subscription terms against sources taken from cloud instances and UBI images.
RESF legal form and CIQ finances are not published.
Infrastructure v2 and the dual-signed shim for the Secure Boot certificate change are pending.