Minimus Releases Hardened Images For Free - What Does It Do Differently?

Minimus Releases Hardened Images For Free - What Does It Do Differently?

Written by Nikos Vaggalis

Wednesday, 29 July 2026

Minimus is a specialized platform designed to provide hardened container images and supply chain security for cloud-native environments. Its images are now free.

Minimus' hardening consists of stripping away unnecessary packages and rebuilding from source daily, hence significantly reducing the vulnerability surface compared to standard public images, up to 98% on average. It achieves such magnitudes in reduction through several key structural and operational strategies:

1. Purposeful minimalism and distro-less design

Standard public images are typically built on top of a full Linux distribution userland, meaning they bundle shells, package managers and dozens of core utilities (like ls, cat and cp) that are never used by the application at runtime. Minimus meticulously strips out this software bloat, leaving only the essential application binary, required dependencies, certificates and core runtime libraries (such as glibc).

This subtraction drastically reduces the number of packages inside the container, as a traditional Ubuntu-based image typically ships with 200 to 400+ packages, while an Alpine-based one ships with 50 to 100 packages. A Minimus production image contains only 10 to 30 packages.

Then, by removing package managers (like apt or apk), shells (like bash) and network utilities (like curl), Minimus successfully eliminates the primary tools attackers rely on for lateral movement and post-exploitation. Fewer packages directly translate to a significantly smaller attack surface, meaning the images naturally accumulate new vulnerabilities at a much slower rate.

2. Direct from source builds

Rather than layering packages on top of an existing third party base image, Minimus compiles and builds all image components directly from upstream sources inside its own secure, SLSA Level 3 pipeline. Because Minimus is operating-system-independent and doesn't rely on downstream Linux distributors (like Alpine or Debian) for package fixes, it can compile and release updated packages within hours of a change in the upstream code.

3. Continuous daily rebuild cadence

Freshness is vital to preventing vulnerability accumulation. Minimus continuously monitors tens of thousands of upstream open source projects for changes. Once a day, the build pipeline automatically rebuilds every actively maintained image version whenever there are package updates or dependency patches to deliver.

Because these daily rebuilds continuously inject the freshest upstream security patches under the hood, the images stay at or near zero CVEs without requiring developers to manually patch or maintain the base layers themselves.

As a platform, it features tools like Image Creator for bespoke configurations, miniCLI for managing images as code and a pull-through proxy that evaluates risks in application dependencies like NPM and PyPI. Users can automate their workflows through Minimus Actions, which trigger notifications or deployments based on image updates, security advisories, or lifecycle changes. Together, they provide a comprehensive framework for organizations to maintain a secure, SLSA Level 3 software supply chain.

But before getting our hands dirty, let's compare Minimus' offering to Docker's hardened images and Bellsoft's ones, as we did for those two in "Docker Releases Hardened Images For Free - What Does It Do Differently?" After doing the analysis, we concluded that:

So which to go for? Answer: it depends. Choose Docker Hardened Images if you want a general-purpose, open-source secure foundation based on familiar OSs (Debian/Alpine) or if you are working with AI agents and MCP servers. Choose BellSoft Hardened Images if you are running Java workloads (specifically OpenJDK/Liberica) and want to leverage performance features like CRaC or require a single vendor to support both your Linux OS and your Language Runtime.

Adding Minimus to the comparison introduces a completely different architectural approach to container security. While Docker and BellSoft focus on securing existing, familiar operating systems (Alpine/Debian and Alpaquita, respectively), Minimus focuses on eliminating the operating system overhead entirely.

Here is how Minimus, Docker Hardened Images (DHI) and BellSoft hardened Images compare across key areas:

1. Underlying architecture & base OS

Minimus-Uses a distroless approach. Instead of stripping down an existing Linux distribution, Minimus builds images continuously from upstream source code containing only the explicit dependencies required to run the application. They remove package managers and shells entirely and default strictly to non-root, unprivileged users.

Docker DHI-Built on established, familiar foundations like Alpine and Debian Linux, aiming for maximum compatibility with...