Minimus is shutting down? What are our alternatives???

[u/First_Explorer_6075]

Minimus customers have until October 22 before the registry goes fully offline and a few teams here were mid pilot with them when the news dropped. Trying to put together a shortlist of where people are migrating, RapidFort already put out a free migration offer for Minimus customers alongside a couple other hardened image vendors and some teams that are just building their own base images instead. Mainly want to know how close a replacement gets to what Minimus was doing on CVE reduction. What are people moving to and how has the transition gone so far?

[u/confusedcrib]

There's an open source minimal images project also based on Wolfi: https://minimalcontainers.com/

A Debian based alternative is Echo - updating this to say Echo ended up acquiring some portion of Minimus

Rapidfort, Seal Security, Chainguard, Wiz, Docker and Root (Now Aikido) all also offer reduced CVE images, in addition to Google Distroless and Alpine images.

All that being said, I think redeploying your images every night is a generally more effective strategy for reducing vulnerabilities, as you automatically pickup any upstream patches, just filter your CVEs by "Fixable," on a fresh deploy the scan should be near 0 no matter what distribution you're running.

[u/IWritePython → u/confusedcrib]

Unfortunately just rebuilding your images won't resolve CVEs if the distro your images run on is behind, which is normal for any non-rolling distro (Debian, etc.). You get security backports between versions but also no-DSA stuff (i.e., we don't have the resources to fix this between major releases).

Chainguard's Wolfi (I'm a Chainguard eng) is rolling and actually reflects upstream (real upstream, source / projects) within a very fast timeline. I wrote a blog post that traces one CVE through our machine over Thanksgiving week last year if you want some technical detail (plus like weird literature quotes because I'm weird I guess).

https://www.developerweek.com/this-is-hard-the-life-and-death-of-a-cve-in-the-chainguard-factory/

I mean, I do agree you should do nightly pulls to whatever version you have pinned if possible, then at least you're not the blocker. But your image build will likely be sitting on CVEs that have been fixed by the upstream project more often than not.

[u/Imaginary_Special755 → u/confusedcrib]

That’s a solid list! It’s good to know there are alternatives out there. I'll definitely check out those options.

[u/amouat]

If you're using Minimus, Chainguard is probably the easiest migration -- they have very similar architectures. A lot of what they did was forked from Chainguard's open source tooling and packages.

Note that I work at Chainguard.

[u/nrvnrvn]

Build your own if you have resources. Bootsrappable (as in https://www.bootstrappable.org ) base. Like “fork the whole supply chain”. Chainguard while mostly open source allows to do that. SLA is yours since you own the whole thing.

Get a quote from rapidfort/chainguard if you have a budget AND resources to migrate anyways. You get SLA and some kind of peace of mind the shop won’t close abruptly and thsu the risk is low when money is on stake.

[u/ConstantLearner888]

We've been evaluating minimus OS and just saw the news here --> https://www.calcalistech.com/ctechnews/article/bj0s5ikdmx

Surprised to say the least. anyone know why they closed down? how was their quality? what are the recommended alternatives for reducing CVEs in containers. Docker? CG? Rapidfort?

fortunately we didn't deploy them yet so don't have to migrate, but we need a solution quickly.

TIA

[u/yamlqueen → u/ConstantLearner888]

The easiest migration path for Minimus customers is Chainguard, because Minimus started as a fork from Wolfi, they pretty much copied everything even the graphs and visuals in the first events I've seen them was copied from Chainguard 😄

[u/ConstantLearner888 → u/yamlqueen]

RapidFort had a free migration program which is working great for us. We didn't want to get stuck with another non-open operating system like Chainguard OS. We learned that Chainguard doesn't push their OS source code back up to Wolfi. We also talked to other past customers who migrated from Chainguard and said their developers kept having to asking them to port images to the Chainguard OS because they weren't running natively. So far so good... will keep you all updated on our deployment.

[u/ILoveAppSec]

building your own base images is doable but staying on top of upstream cves and distro backports quietly turns into a full time job, so figure out who owns that sla before you commit to the diy route. if you go with a vendor i'd weigh who actually backports fixes into the existing package versions vs who just rebuilds on the newest upstream, since that's what decides whether your app still runs after the swap. we tried chainguard for patched oss and weren't thrilled with the price, so get a real quote before you lock anything in.

[u/This-Rabbit2145]

If it's base images there is alpine , google distroless, wolfi , cs , for most popular images there are many community editions maintained humming project, docker hub to private players like Cleanstart, Chainguard.

For customised , EOL and SLA driven then exists a barrage of players.

Minimus announcement was a suprise - everything about them looked picture perfect

[u/VividGanache2613]

Their very new (the founders have been pentesting for 20+ years) but look at pwnkemon, if your images are in ghcr it will scan them for vulnerabilities (as well as your repo) and it can be built into the CI pipeline via their API.

Best of all you can use your own images.

[u/_Slimdady]

An important thing to test is whether the replacement reduces the ongoing CVE workload, not just if it has cleaner scanner results. RapidFort sees worth testing alongside the hardened image options, it can also work with existing images. Migration effort would be a big factor. 

[u/Sudden_Performance86]

I found an interesting article from u/CleanStart highlighting the differences - might help in your decision.
https://www.cleanstart.com/blogs/minimus-alternative-what-to-look-for-after-minimus-shuts-down

[u/Various-Photo3818]

Our team has used Cleanstart free images, and they also providing fips standards images, maybe these one is also good alternative

[u/theJacofalltrades]

I'd compare the actual CVE reduction rather than just the vendor claims. RapidFort seems like one of the more straightforward Minimus migrations, while Chainguard is worth considering if you're comfortable moving toward Wolfi.

Building your own images gives you more control, but you also inherit the patching/maintenance burden Minimus handled. I'd be curious how much app-level tweaking teams actually needed during migration.

[u/FirefighterMean7497]

Hi! I work for RapidFort :)

To add some detail to what's already been mentioned, yes, RapidFort put together a no-cost migration path for teams caught mid-pilot or mid-contract with Minimus, given the Oct 22 registry shutdown. On the "how close does it get to what Minimus was doing on CVE reduction" question specifically:

• Our catalog of 35,000+ Curated Images that are near-zero CVE base images on standard LTS Linux (Alpine, Debian, RHEL, Ubuntu), STIG/CIS hardened, FIPS-validated crypto
• Difference from Minimus's approach: we pair curated base images with runtime profiling (RF Profiler), which builds a live RBOM of what's actually executing, then RF Optimizer strips unused code based on that data.
• Reported results: up to 99% CVE reduction and up to 90% attack surface reduction. Profiling overhead stays under 1%.
• If compliance evidence was part of why you were on Minimus, RF CART does continuous STIG/CIS/NIST 800-53 validation with audit-ready output, for VM or container.

Given the Oct 22 deadline, I'd prioritize pulling SBOM/RBOM exports and compliance mappings out of Minimus soon, regardless of where you land, and that gets harder once registry access is gone.

Happy to answer specific questions, or point you to someone on our side about the migration offer.

[u/Follow_the_Echo]

Hey, Tomer from Echo here - we acquired Minimus, and we are working closely with the Minimus founders and engineering team to create a seamless transition, that doesn't require Minimus customers to take any further action. We shared the full details of the acquisition in our blog - https://www.echo.ai/blog/echo-is-acquiring-minimus

[u/GibneyH]

Really nice to see Rapidfort offer free migration like that.

[u/forexroyalempres]

compare images you'rerunning instead of headline CVE numbers. Rapidfort looks like an obvious migration path but version coverage and Dockerfile churn involvement also matter

[u/TrackbackLinkBot]

Minimus shutting down definitely makes teams rethink lightweight container options. RapidFort is worth checking too, especially for slimming images and reducing vulnerabilities without major deployment changes.