Why Minimus Is Giving Away Hardened Containers for Free

Free stuff on the internet usually comes with a catch. Free security tools, even more so. So when a company says “take our entire product catalog, no signup, no strings attached,” it is worth asking what is really going on. That is exactly what Minimus just did with its hardened container images, and the reasoning behind it says a lot about where application security is headed.

Source: Unsplash 

In this article, we will break down what Minimus announced, why it matters for developers, and what it signals about the future of software supply chain security.

What did Minimus actually announce

One of the advantages posed by the company Minimus is that it has provided its entire range of hardened container images free of charge, enabling developers to download them without registering. This last point matters a lot. Many free security products that offer a free tier still require you to create an account, provide an email address, or even go through a sales pitch before you can access the product. In this case, Minimus has removed all these obstacles.  

According to the CTO John Morello, the goal is simple. Developers, in case they have too many hoops to jump through will abandon the use of a particular secure container image. They will choose whatever is faster, even if it is more dangerous. By providing them with free access to a full catalog, application teams will work with the hardened images the same way as production teams do now without waiting for approvals, contracts, and purchases.  

Unlike other image catalog services, Minimus does not limit the number of images developers can download from its catalog as well.

What makes these images “hardened”

Minimus creates so many container images that have known vulnerabilities removed from them. These are made as drop-in replacements for the container images that different teams have in use, so they don’t have to redesign their application or alter their workflow. 

Every container image is always constructed from scratch and is not dependent on any particular distribution of Linux. This minimizes the attack surface because less unnecessary software is included in the images.

Minimus also has developed a command-line tool called minicli, which allows inquiring about possible container images, their configuration, and automating the transition to more secure versions of the images.

Why give away the product for free

This is the part that raises eyebrows, and the answer is fairly straightforward. Minimus is not planning to make money from the images themselves. Instead, it will focus on selling support services through an Enterprise Edition of the platform, aimed at organizations that have already adopted those free images and now need help maintaining them at scale.

Mitch Ashley, a vice president at Futurum Group, put it well. When hardened base images are unrestricted, they essentially become a commodity. The real value shifts to whoever can keep those images continuously rebuilt, patched, and supported over time. In other words, the competition is no longer about who scans and patches fastest. It is about who ships so little vulnerable code in the first place that there is barely anything left to scan.

Why this matters right now

The importance of application safety has always remained vital, but AI has accelerated the threat and enabled hackers to find vulnerabilities within codes in minutes if not hours, and in normal cases, reverse engineer effective exploits in hours instead of weeks or months as it was earlier.

In the past, many developers have taken advantage of pulling container images from public repositories without thinking about the security risks that may be hidden there. But this attitude is becoming increasingly difficult to defend. The question is no longer whether hardened images will become common practice; it is rather about when that will actually happen.

The bottom line

Minimus believes that taking away obstacles will be the quickest solution to make safety better in the whole industry. It is very difficult to go against such reasoning. If developers can get a safer container image as easily as they get an unsafe one, it means that they would usually pick a safer one outright.

If your team still uses images that have not been approved for security purposes, now it is high time to reconsider this process before it leads to even greater problems. Explore the advantages of a hardened image catalog in your pipeline and how much risk you can eliminate from it even before the production stage is reached.