29 comments

[ 2.8 ms ] story [ 52.1 ms ] thread
John here (CTO and Co-Founder)… we’d be happy to answer any questions anyone has!
What can you say about long-term plans? The bitnami situation burned a lot of people I think, and yes we can cache your images, but switching providers still does not come for free.
Thank y'all so much for doing this. I really appreciate y'all not putting STIG/FIPS behind the paywall. Rare and aggressive move.
Hello John, happy to hear that the image is free to the community, what a great contribution. May I know what is the underlying method to build the distroless image? Chainguard recently delete most of the cloud native application in their community repository, and I'm figuring how to get away from wolfi melange and apko. My closest bet is nix pkgs, but it would be great if you can share what you are using in Minimus :)
Asking the very obvious question (as it's not apparent from the website): Why would I use this over DHI (Docker Hardened Images) or Chainguard Images, both of which also have a set of free hardened images?
The free tiers always go away, after they're deep in our infra. I would prefer to price it from the start.
Is their ingress-nginx-controller image similar to that of Chainguard: a drop-in replacement with the CVEs fixed?
Where are these built? Can I see the Dockerfiles? How are they licensed? I get that they are free as in beer, but not libre/FLOSS?
Since we started paying for Chainguard I’ve become super sold on the benefits of minimal and continually patched images. It’s just a shame that the open source community only gets to benefit from the limited free library DHI and Chainguard offer. I understand it costs money though and that needs to come from somewhere.
Completely blocking the image information page to mobile user agents is completely unnecessary. I'd much rather look at your non optimized page than be told to come back on desktop.

Moreover, even after switching to desktop mode on my phone, there's nothing I see that precludes you from employing a little bit of CSS to make those pages render more nicely on mobile screens.

Turning on "Desktop Site" on Firefox Android lets me through. Not that I disagree, just a workaround.
I have no idea what the heck is this, maybe it’s a great product but a very poor website in telling what I am getting into, is this better than the usual containers? How? Supported platforms? Can I run it on arm? The usuals
I truly don't get this. What is the security policy here? Why should I trust images built by minimus.io? How do I know they don't contain malicious software? What's the point?
this space is too crowded now. everyone is copying whatever Chainguard is doing

- Chainguard Images

- Chainguard Libraries

- Chainguard VM

...

Because Chainguard cost an arm and a leg.
Free markets work :)

With Minimus Community Edition, you now have access to 1,000s of built from source, near 0 CVE images without cost or friction

Supply chain attack waiting to happen
Maybe it's their business model? Sell to bunch of people and hook them in, then "get hacked", whoops sorry.

Edit: honestly I'm flagging this post. This really looks like fishing for customers to make them vulnerable in future.

How? If this, then so is DHI.
What's the availability story? Docker Hub has pretty severe rate-limiting even if you're not an anonymous user.
In the risk reduction tab, it should compare the vulnerability count against the node-slim image. In my eyes, it takes away from the offering when they try to prop up the vuln count for the official images, and nobody deploys `node:latest`.
I'm interested in using these images on exe.dev. exe supports any oci images and stands it up as a microvm, in which it would be used non-ephemerally from that point. I'm assuming the images don't have any rc/services. How hard would it be to pull that back in after image deployment? (Also looks like I'd want to use the -dev images which include shell/apk, etc)
Thank you for this! Super valuable for contribution to all businesses. Suppose I want to add a custom PHP extension such as NewRelic, how would I go about adding that on your distroless images?
Is the cli open source? What about the images themselves?

An easy comparison is wolfi, which is completely open source.

used bitnami images and charts that depended on them, then they pulled them back after being bought by broadcom causing headaches. not getting bit by the rugpull again sorry.