Show HN: Minimal – Open-Source Community driven Hardened Container Images

74•ritvikarya98•7h ago

I would like to share Minimal - Its a open source collection of hardened container images build using Apko, Melange and Wolfi packages. The images are build daily, checked for updates and resolved as soon as fix is available in upstream source and Wolfi package. It utilizes the power of available open source solutions and contains commercially available images for free. Minimal demonstrates that it is possible to build and maintain hardened container images by ourselves. Minimal will add more images support, and goal is to be community driven to add images as required and fully customizable.

Comments

debarshri•6h ago

This is great. I have been talking to quite some vendors in the space. I have looked in docker hardened images too. They have made it free too.

I think the problem in general is hardened image market is keeping up with CVEs and making sure the catalog is vast so that it covers all the images and nuances.

Responding and patchibg CVEs with an SLA is the KPI of the vendors. As much as I would like cheer for you, doing it as an opensource initiate with a guaranteed SLA is going to be painful for you as maintainer without profit as a motive.

ritvikarya98•6h ago

Thanks for looking into this! I agree with you and hence I'm also relying on Wolfi packages, which will ensure they are updated as soon as upstream is available so I'm piggy backing on that. Github Actions run daily/weekly based on the cadence and once the pipeline is setup do not require a significant effort imo. And I want it to be community driven so we can add images as and when people want it and build it accordingly. Chainguard tools surely help with this! I aim to show that companies can try and build internal pipelines like this for all images in their repository

hobofan•5h ago

Isn't this mostly the same thing that Chainguard already provides themselves? E.g. the "Free" images on their page [0] have a big overlap with the toolchains from your repo.

[0]: https://images.chainguard.dev

ritvikarya98•4h ago

Some images do overlap yes, but they are some of the most popular ones used and I wanted to demonstrate how they can be build as well. Half of them are only available through paid versions. I will be adding new images on regular basis, based on usage and impact.

hobofan•3h ago

Ah, nice! I also just tried to look up how the official Chainguard images are built, and while the are open source they are less straightforward to follow.

I was looking into how to create more secure container image and this looks like a great resource! :)

Imustaskforhelp•3h ago

> Some images do overlap yes, but they are some of the most popular ones used and I wanted to demonstrate how they can be build as well. Half of them are only available through paid versions. I will be adding new images on regular basis, based on usage and impact.

This looks really good. Good luck for your project!

Also a quick question but when you mention Minimal being well.. Minimal? How much more minimal would it be compared to say alpine?

Also maybe I should stop saying so many times minimal in this comment haha!

ritvikarya98•15m ago

I think it depends on your use case, an image can be as small as default static, but if you need more, we need to add packages. Minimal images make sure we do that with least attack surface.

anukritisingh•6h ago

Looks very useful, we should definitely build up on this!!!

Joel_Mckay•5h ago

Hard pass...

In general, a public security policy is pointless. It is the one layer you want people to trip over when breaking a system. =3

tigerinthe•5h ago

Why do you say so?

Joel_Mckay•5h ago

Best to look at security policy using ecological predator-prey models. If you don't, than you fall victim to the assumption a "puzzle" you can't break is unbreakable in general.

Nuisance users don't publish CVE, and a zero trust model shows you something important. =3

Imustaskforhelp•3h ago

Joel a little offtopic but looks like we have bumped into each other 3 times now (I remember you from VM comment and then today on a different comment and now this)

I am curious to ask now but why do you end every message with =3 & when did you start with this trend, really curious now xD

Joel_Mckay•2h ago

Don't worry about it... =3

anukritisingh•1h ago

yeah, really curious at this point.

adriand•5h ago

Dumb question but how would these work in practice? I use kamal to deploy containerized applications. Would I on a regular basis update the versions of the underlying images to match the latest hardened container and then redeploy? I assume this is automatable?

ritvikarya98•3h ago

Hi thanks for looking - I would preferably more info on your setup, but this is similar to using any container image. Currently all the tags are latest and if you have that setup you would pick that up from this repo and pretty sure this can be automated.

humayuuun•5h ago

Need more information on how I can integrate this in my pipeline but this looks promising

Dayshine•4h ago

Why does this not use chisel? I assume you at least drop the bin dir? Although the presence of ncurses is super weird

I don't understand why one would go halfway and leave packages which are unneeded for services. The only executable in a hardened container image should be your application.

ritvikarya98•4h ago

Thanks! but these are builder images, not the final runtime. Chisel only really makes sense after the binary is built and you know what it needs at runtime. Before that you are pulling in whole packages, which is why things like ncurses might show up, similar to chainguard's image. For a builder, it is just SBOM noise and not something the app ever executes. Its hard to identify what you need before running the application, and you can always find a library you don't need. The “only your app should be executable” idea works for fully static binaries, but once you use glibc or CGO you already have other executables.

dgrove•2h ago

I'm not sure what problem this is solving. This seems like chainguard but being built in "your ci" (github) vs "their ci". Images may be a bit smaller, but this is already a feature set that wolfi already allows for. Besides that chainguard is not full-source bootstrapped.

theoo21•1h ago

From reading the project readme, I think this demonstrates creating any image you want using Chainguard's tools including commercial ones.

lmeyerov•2h ago

I have been curious on secure base images for the AI ecosystem, where we need to ship with cuda 11.8/12.8/13.1 for stability reasons, and in our case, a bit of the torch ecosystem and Nvidia rapids ecosystem. That ends up being... A lot. Extra fun: going all the way to FIPS..

euph0ria•2h ago

What is the process to trust the usage of this?

How can we learn the identity of the contributors? How are the contributors vetted? How are we notified if a significant change in leadership happens?

It's just a general problem when relying on GitHub accounts for important code.

For some reason I trust the big vendors to have better safe-guards against things like the questions above. Such as aws linux containers etc..

Would love to hear how other people think around this.

Swift is a more convenient Rust

OpenClaw Security Assessment by ZeroLeaks [pdf]

Mobile carriers can get your GPS location

Scientist who helped eradicate smallpox dies at age 89

Apple-1 Computer Prototype Board #0 sold for $2.75M

In Praise of –dry-run

Generative AI and Wikipedia editing: What we learned in 2025

Opentrees.org (2024)

The Saddest Moment (2013) [pdf]

Berlin: Record harvest sparks mass giveaway of free potatoes

Demystifying ARM SME to Optimize General Matrix Multiplications

Outsourcing thinking

Data Processing Benchmark Featuring Rust, Go, Swift, Zig, Julia etc.

Show HN: Minimal – Open-Source Community driven Hardened Container Images

Finland looks to introduce Australia-style ban on social media

Nintendo DS code editor and scriptable game engine

Ferrari vs. Markets

CollectWise (YC F24) Is Hiring

U.S. life expectancy hits all-time high

CPython Internals Explained

Wikipedia: Sandbox

Writing a .NET Garbage Collector in C# – Part 6: Mark and Sweep

Apple Platform Security (Jan 2026) [pdf]

Noctia: A sleek and minimal desktop shell thoughtfully crafted for Wayland

Nvidia's 10-year effort to make the Shield TV the most updated Android device

History of the browser user-agent string (2008)

Working example of a Yocto setup without unnecessary complications

We have ipinfo at home or how to geolocate IPs in your CLI using latency

Show HN: Moltbook – A social network for moltbots (clawdbots) to hang out

Giving up upstream-ing my patches and feel free to pick them up

Swift is a more convenient Rust

OpenClaw Security Assessment by ZeroLeaks [pdf]

Mobile carriers can get your GPS location

Scientist who helped eradicate smallpox dies at age 89

Apple-1 Computer Prototype Board #0 sold for $2.75M

In Praise of –dry-run

Generative AI and Wikipedia editing: What we learned in 2025

Opentrees.org (2024)

The Saddest Moment (2013) [pdf]

Berlin: Record harvest sparks mass giveaway of free potatoes

Demystifying ARM SME to Optimize General Matrix Multiplications

Outsourcing thinking

Data Processing Benchmark Featuring Rust, Go, Swift, Zig, Julia etc.

Show HN: Minimal – Open-Source Community driven Hardened Container Images

Finland looks to introduce Australia-style ban on social media

Nintendo DS code editor and scriptable game engine

Ferrari vs. Markets

CollectWise (YC F24) Is Hiring

U.S. life expectancy hits all-time high

CPython Internals Explained

Wikipedia: Sandbox

Writing a .NET Garbage Collector in C# – Part 6: Mark and Sweep

Apple Platform Security (Jan 2026) [pdf]

Noctia: A sleek and minimal desktop shell thoughtfully crafted for Wayland

Nvidia's 10-year effort to make the Shield TV the most updated Android device

History of the browser user-agent string (2008)

Working example of a Yocto setup without unnecessary complications

We have ipinfo at home or how to geolocate IPs in your CLI using latency

Show HN: Moltbook – A social network for moltbots (clawdbots) to hang out

Giving up upstream-ing my patches and feel free to pick them up

Show HN: Minimal – Open-Source Community driven Hardened Container Images

Comments