Most of a container's CVEs live in base-image software your app never touches: the shell, the package manager, a hundred unused libraries. Minimus ships hardened distroless bases built from source with near-zero CVEs, drops in with a one-line change, and is free since June 2026. The catch is the usual distroless one: no shell, so you debug from the outside.
tag: #containers
2 posts
PID 1 in Linux has special responsibilities that most application processes are not designed to handle. The --init flag in Docker inserts a tiny init process between PID 1 and your application, which solves the zombie reaping problem and the signal forwarding problem in one line.