Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- Is the cli open source? What about the images themselves?
An easy comparison is wolfi, which is completely open source.
by csnoob - Is their ingress-nginx-controller image similar to that of Chainguard: a drop-in replacement with the CVEs fixed?by crabique
- yes it isby stamod1
- I see this is a packaging service with greater traceability and velocity than the rando images on docker hub.
I believe that they will always supply the bleeding edge stable release, but it will always be your responsibility to monitor and manage issues like CVEs, rather than expecting them to do it for you.
by greggsy - Thank you for this! Super valuable for contribution to all businesses. Suppose I want to add a custom PHP extension such as NewRelic, how would I go about adding that on your distroless images?by euph0ria
- Depends on your preferences but probably easiest approach is to take the -dev version of our PHP image and run a build from that to add whatever you need on top of that hardened base.
You can even do a multi step build if you want to use the fully minimalistic image at runtime. Details at https://docs.minimus.io/foundations/going-distroless
by morellonet - In the risk reduction tab, it should compare the vulnerability count against the node-slim image. In my eyes, it takes away from the offering when they try to prop up the vuln count for the official images, and nobody deploys `node:latest`.
- > nobody deploys `node:latest`
Oh how I wish that were true.
by itintheory - What's the availability story? Docker Hub has pretty severe rate-limiting even if you're not an anonymous user.by biimugan
- No rate limiting or degradation of service for Community Edition. Same images, same registry as Enterprise Edition.by morellonet
- I'm interested in using these images on exe.dev. exe supports any oci images and stands it up as a microvm, in which it would be used non-ephemerally from that point. I'm assuming the images don't have any rc/services. How hard would it be to pull that back in after image deployment? (Also looks like I'd want to use the -dev images which include shell/apk, etc)by indigodaddy
- Correct they do not have any rc
I’m not personally familiar with exe.dev but if it can run normal OCI images it should be pretty simple to use ours. If you want a shell and package manager and some common busybox applets, -dev variants are the best option.
by morellonet - The free tiers always go away, after they're deep in our infra. I would prefer to price it from the start.by figassis
- We would be happy to sell it to you today! :)
This is our new Community Edition, which are all the exact same images as the Enterprise Edition product customers around the world already use, just without all the other features like image creator, self hosting, integrations, SSO, etc. Click the discover Enterprise Edition button on lower left and you can see a quick comparison table or go to minimus.io to see all the details.
EE also includes contractually backed CVE remediation and support SLAs. If you’d like to try EE and get pricing details, we’d be happy to help! Just click the button on the lower left to get started.
by morellonet - Since we started paying for Chainguard I’ve become super sold on the benefits of minimal and continually patched images. It’s just a shame that the open source community only gets to benefit from the limited free library DHI and Chainguard offer. I understand it costs money though and that needs to come from somewhere.by cedws
- This is exactly why we’ve made Community Edition free. The value of hardened, well maintained images to the world writ large is huge.
We believe there is sufficient value to enterprises in the SLAs and broader feature set to build a great business while making the core benefit available to everyone without friction.
by morellonet - John here (CTO and Co-Founder)… we’d be happy to answer any questions anyone has!by morellonet
- Thank y'all so much for doing this. I really appreciate y'all not putting STIG/FIPS behind the paywall. Rare and aggressive move.by stusmall
- What can you say about long-term plans? The bitnami situation burned a lot of people I think, and yes we can cache your images, but switching providers still does not come for free.by _def
- Is there a single upstream that all images are based on? Debian? Arch? Alpine?
Curious how this plays into customizing images with creator, are you guys responsible for all the packaging?
Would my keester be on the line if say an upstream package got hit with an attack but I use it through creator?
- Any plans to add IPv6 support? NAT GW are costly and docker hub has full support.
currently reg.mini.dev does not have AAAA records. Did not check the blob storage endpoints.
by miyuru - Just a little bit of feedback: some items on the main page are duplicated, which could be confusing. For example, "nginx-advanced" appears as updated both 3 days ago and 2 hours ago.by ftchd
- Hello John, happy to hear that the image is free to the community, what a great contribution. May I know what is the underlying method to build the distroless image? Chainguard recently delete most of the cloud native application in their community repository, and I'm figuring how to get away from wolfi melange and apko. My closest bet is nix pkgs, but it would be great if you can share what you are using in Minimus :)by briansioscl
- Where are these built? Can I see the Dockerfiles? How are they licensed? I get that they are free as in beer, but not libre/FLOSS?by zufallsheld
- Currently, yes free as in beer. We build every component directly from source in a SLSA 3 environment we run (mostly in GCP). Making the Dockerfiles available is a fair question, not something we’ve done thus far because it’s not particularly useful if you don’t have all the infrastructure building the components.
Do you have particular scenarios you’d like the Dockerfiles for or is it just for transparency/ trust (which is a totally valid reason of course)?
by morellonet - Asking the very obvious question (as it's not apparent from the website): Why would I use this over DHI (Docker Hardened Images) or Chainguard Images, both of which also have a set of free hardened images?by hobofan
- Agreed. Also on front page the nginx container is 6 days old, so no daily buildsby phishin
- 1. These are all >1200 of our images, including FIPS, and all versions… others gate many of their images
2. These are all built continuously from upstream source on a distroless base… this makes a significant difference in attack surface and CVE count re DHI images and you can easily check our word with a few scans
3. These are truly free… no auth wall, no signup, no trial, no limit on numbers of images or pulls or anything like that
4. We have really invested in making these agent ready… we have a CLI (minicli) designed for both humans and agents to easily discover, understand, migrate to, and build on them… for example, check out the AI migration prompts we provide for each image, we’ve refined these across many customer deployments such that you can copy paste into your agent of choice, point it at a Dockerfile and have it do all / nearly all the work to move to these images
by morellonet - Completely blocking the image information page to mobile user agents is completely unnecessary. I'd much rather look at your non optimized page than be told to come back on desktop.
Moreover, even after switching to desktop mode on my phone, there's nothing I see that precludes you from employing a little bit of CSS to make those pages render more nicely on mobile screens.
by charukiewicz - Fair complaint. As with all software development we make tradeoffs to try to balance time and capability. I’ll make sure our front end lead see this though :)by morellonet