Most of a container's CVEs live in base-image software your app never touches: the shell, the package manager, a hundred unused libraries. Minimus ships hardened distroless bases built from source with near-zero CVEs, drops in with a one-line change, and is free since June 2026. The catch is the usual distroless one: no shell, so you debug from the outside.
tag: #tips
1 posts