Minimus

Your container's CVE count is mostly not your code. It is the base
image: the shell you never call, the package manager you removed at
build time and shipped anyway, the hundred libraries the app never
loads. A python:3.12 or node:22 base drags in a full distro, and
every scan lights up with vulnerabilities in software your app does
not use.

Minimus (images.minimus.io) is one answer worth knowing. It ships
hardened, distroless base images built continuously from source, with
only the components an app actually needs at runtime. No shell, no
package manager, no debug tools. The claim is around 95% fewer CVEs
than standard bases, often near zero, and the images come with signed
SBOMs so you can see exactly what is inside.

The reason to care in practice:

Drop-in replacement. The images are API-compatible with the common
public ones, so adopting them is usually a one-line change to your
base image in the Dockerfile or deployment, not a rebuild of your
pipeline. Nginx, Python, Node, Postgres, and the smaller supporting
components are all there across versions.

Free now, no auth wall. As of the June 2026 Community Edition, the
whole gallery is available without registration or a signup. You can
pull and try one this afternoon.

Fewer CVEs by construction, not by patching. The point is not that
they patch faster, though they publish remediation commitments. The
point is the vulnerable software is not in the image to begin with.
That is a different and better frame than the endless scan-and-triage
treadmill: most of the CVE noise came from base-layer bloat you never
needed.

The Honest Catch

No shell means your old debug reflex is gone. You cannot docker exec -it ... sh into a distroless image, because there is no sh. This is
the same tradeoff as any distroless base, and the answer is the same:
debug from the outside with an ephemeral container that carries the
tools, kubectl debug --target on Kubernetes or a sidecar debug
container on plain Docker, rather than baking tools into the image
that an attacker would also enjoy.

And a minimal base is not a security program by itself. It shrinks the
attack surface and clears the CVE noise, which is real and worth
having, but your application dependencies, your config, and your
runtime still need their own gates. A near-zero-CVE base with a
vulnerable app on top is still a vulnerable container.

The Takeaway

Most of your image's vulnerabilities live in base-layer software your
app never touches. A hardened distroless base like Minimus removes
that software instead of patching it, drops your CVE count by
construction, and swaps in with a one-line change. Try one as a drop-in
under a real service, confirm it still runs, and check the scan
difference.

Your CVE count is mostly base-image bloat, not your code. Swap in a
hardened distroless base, remove the vulnerable software instead of
patching it, and debug from the outside since there is no shell.