Minimus has opened its full catalog of distroless container images to the public at no cost, offering a library that the company claims reduces application security vulnerabilities by more than 95 percent compared to standard base images.

The company, which launched at RSAC in April 2025, builds images — these are essentially pre-packaged bundles of software — that include only the runtime dependencies an application strictly requires. Nothing else. No shell interpreter, no package manager, no extra tools that could serve as entry points for attackers. That philosophy, called distroless, has existed in fragments for years, but Minimus frames its offering as a maintained, production-ready catalog rather than a starting point you assemble yourself.

The Market Context

The timing reflects real market movement. Container image supply chains have shifted noticeably over the past year.

Broadcom announced in September 2025 that most Bitnami container images—widely used building blocks for deployment—would move to a paid model, disrupting teams who had built their entire CI/CD pipelines around Bitnami's free offerings. MinIO followed in October 2025 by stopping publication of free images to Docker Hub. And Docker itself made a direct move: on December 17, 2025, it released Hardened Images under the Apache 2.0 license, positioning them as free, security-focused base images.

Across these shifts, platform and infrastructure teams can no longer assume a broad library of free, actively maintained container images will be available. Minimus is filling that gap.

What Minimus Delivers

The 95-percent vulnerability reduction claim rests on a straightforward principle: attack surface math. A standard Debian or Ubuntu image includes hundreds of software packages, most of which a typical application never uses. Each package carries its own history of security flaws and requires its own security updates. A distroless image built around only the required runtime removes most of that exposure by design—you can't be attacked through code that isn't there.

Minimus extends distroless principles to virtual machines as well, not just containers, which matters for workloads where container runtimes aren't available or aren't permitted.

Freely available images now cover a range of programming language runtimes and application stacks that were previously behind paywalls or restricted access.

One observation worth noting: Minimus itself published the 95-percent-plus figure. Independent benchmarking by third parties using a standard set of images would give security and procurement teams a firmer foundation for decisions. That said, the underlying logic is sound and aligns with what other distroless projects have consistently shown.

Why This Matters for Security Teams

For security engineers managing a fleet of thousands of containers, the real measure is not the total number of security flaws in any single image—it is the total scanning and review workload across the entire deployment. Fewer packages per image means fewer security alerts, faster review cycles, and a smaller pool of real issues that need fixing. At scale, this difference compounds quickly.

Platform teams have a different concern. A free catalog only helps if it stays current. Images that fall behind upstream software releases become vulnerabilities themselves. How Minimus handles update frequency, end-of-life policy, and staying synchronized with upstream releases will determine whether this catalog actually works in production—questions that only a track record can answer, not marketing materials alone.

The bigger picture is that the distroless and minimal-image space is now genuinely competitive. Docker Hardened Images, Chainguard's offerings, and a fully open Minimus catalog give platform teams real alternatives to the general-purpose images that dominated container deployments for years. That competition tends to improve the baseline. For an industry that treated base image quality and origin as an afterthought for a decade, a higher baseline matters.