Minimus makes its hardened container images free — the thread asks who pays later
A startup drops the paywall on a catalog of minimal, CVE-reduced container images, and the CTO shows up in the comments to take questions. The first question isn't about security.
Minimus publishes hundreds of distroless images with per-image vulnerability-reduction percentages — nginx at 100%, python at 98% — now free with no SLA or guaranteed patch timing, while paid tiers get fixes first.
The thread, with the co-founder present, circles one worry: free tiers vanish once they're load-bearing. Engineers also press on the unanswered basics — no Dockerfiles, unclear licensing, and a supply-chain trust gap against open-source Wolfi.
A hardened-image catalog drops its paywall
Minimus has opened free access to its catalog of hardened container images — minimal, distroless builds of popular open-source software, spanning infrastructure, data, AI and base images, many shipping in FIPS-compliant and 'advanced' variants alongside Helm charts.
Each image advertises a reduction percentage that stands in for stripped attack surface and eliminated CVEs: nginx at 100%, python at 98%, elasticsearch at 92%. The free tier comes without support, SLA, or guaranteed patch timing, and the page is explicit that security updates may reach paid subscribers first. Even the word 'hardened' gets a disclaimer: it describes configuration at build time, 'not a guarantee of ongoing security or absence of vulnerabilities.'
The CTO showed up, and the questions went sideways
The co-founder opened the door himself.
"John here (CTO and Co-Founder)… we'd be happy to answer any questions anyone has!" — the company's co-founder
The top reply skipped the tech entirely and went straight at the business model.
"The free tiers always go away, after they're deep in our infra. I would prefer to price it from the start." — a founder who builds fintechs
A platform engineer named the elephant: the field is already crowded with the same pitch.
"Why would I use this over DHI (Docker Hardened Images) or Chainguard Images, both of which also have a set of free hardened images?" — a DevOps engineer
Others pressed on trust and provenance — and on the openness gap that competitors like Wolfi don't have.
"Where are these built? Can I see the Dockerfiles? How are they licensed? … I get that they are free as in beer, but not libre/FLOSS?" — a commenter asking for build provenance
"Supply chain attack waiting to happen" — a skeptical engineer
The sharper product note came from someone reading the marketing closely: the comparison baseline is rigged. Vuln counts are shown against node:latest, an image nobody actually deploys.
"In the risk reduction tab, it should compare the vulnerability count against the node-slim image… nobody deploys node:latest." — a commenter auditing the benchmark
The real bar 'free' has to clear here isn't price — it's whether a closed-source image with no published Dockerfile can earn the trust that an open base like Wolfi gets by default.
Get breakdowns like this every day
The top Hacker News stories, unpacked — by email, Telegram, or RSS.
323 new R packages in one month — and 40 shipped with no README
A long-running CRAN curation project hits a wall: the monthly intake has grown so fast that sorting signal from noise has become a part-time job, and a chunk of submissions arrive with no docs at all.