Minimus

What the company sells

Minimus sells minimal container images that it rebuilds from upstream source, with only the packages needed to run the application. Minimus is winding down operations, and Echo has acquired key Minimus technology and assets. Minimus says it is working with the Echo team and meeting with every Minimus customer to provide support during the transition period.

Minimus images contain only the software needed to run the application. Minimus images have shells, package managers, and network utilities stripped out. Minimus builds its images from source continuously, and the images are OCI-compliant, with FIPS 140-3 modules available. Minimus compiles each application in a SLSA 3 build environment from upstream project source code and includes only the libraries the application needs to run. Minimus monitors tens of thousands of open source projects and rebuilds images in a SLSA Level 3 pipeline when updates occur. Minimus provides images for LLM, app development, and cloud native infrastructure.

Minimus gives a contractual guarantee of zero known CVEs at delivery, with a 48-hour remediation SLA for newly disclosed vulnerabilities. Minimus patches critical CVEs within 48 hours of upstream availability, and high and medium CVEs within 14 days. Minimus sets a 24 hour SLA for critical and high CVEs on KEV, and 48 hours for all other critical and high CVEs. Minimus offers FIPS 140-3, STIG, NIST and CIS ready images for sensitive workloads. Minimus images come with automated testing and documented results per build, and support FedRAMP, DORA, and NIS2 posture requirements. Minimus is both SOC-2 and ISO 27001 certified, and Minimus makes the reports available by request.

Minimus lets customers configure their own hardened container images, and Minimus takes care of the updates and maintenance. Customers can build atop the thousands of secure base images from Minimus. Minimus draws real-time threat intelligence from EPSS, CISA-KEV, and Minimus Labs to prioritize upstream vulnerabilities by actual likelihood of exploit.

Minimus offers Actions to integrate with tooling such as GitHub, Slack, and webhooks. Minimus automatically triggers events in Slack, Jira, GitHub, and more. Minimus connects to development, chat, and ticketing tools and to the rest of a security stack. Minimus provides skills and config tools for Claude, Codex, Cursor, and more to migrate to and build on Minimus images.

Minimus offers a SaaS management console, and images can be pulled from the Minimus registry or from whatever registry a customer uses, including air gapped ones. Minimus supports pulling from the registry of your choice, with fully air-gapped support available, and Minimus publishes Hardened Helm Charts versioned by Minimus. Minimus can sync images to the registries a customer already uses, even air-gapped ones. Minimus images are API-compatible with what customers already run, and the change is an update to the Dockerfile followed by a rebuild.

Minimus offers open access to hardened images for everyone, with an upgrade for private builds, SLA-backed support, and the controls enterprise teams need. Minimus offers 1,000s of near 0 CVE images built from source. Minimus is built for the needs of enterprise security teams and fast moving developers. Global financial institutions and startups are named as customers of Minimus. The Minimus founders created Twistlock, which Palo Alto Networks acquired, and authored NIST SP 800-190, the federal standard for container security. Minimus has a global team that provides round-the-clock support, 365 days of the year.^[5][6][7]

Categories

• Software supply chain security (primary category)
• Compare Minimus with companies in the same categoryside by side

Headquarters

Not established from our sources

Founded

Not established from our sources

Ownership

Not established from our sources

CISO on record

Not yet on our record. Send a verified source

Website

minimus.io

Products and services

Product names as the company writes them; what each does, in our words, from the company's own product pages. Never how well it does it.

• Minimus Images^{[1][4][5][6][8]}

  Minimal container images rebuilt from upstream source with only the packages needed to run the application.

  Minimus images contain only the software needed to run an application, with shells, package managers, and network utilities stripped out. Minimus builds them from source continuously, and they are OCI-compliant, with FIPS 140-3 modules available. Minimus rebuilds images in a SLSA Level 3 pipeline when upstream updates occur.

• Hardened Helm Charts^[6]

  Helm charts that are native and versioned by Minimus.

  Minimus publishes Hardened Helm Charts that are native and versioned by Minimus. Customers can pull from the registry of their choice, and fully air-gapped support is available.

Competitors and alternatives

The other companies on our record filed under the same categories, category by category: first those that lead with that category and share more of Minimus's categories, then alphabetical. A list from the record, never a ranking.

• On software supply chain security, Minimus competes with Anchore, Archipelo, Chainguard, JFrog, RapidFort, Red Hat, Socket, Apiiro, Aqua Security, Arnica and 15 more.

References

Every fact above cites one of these by number. Tier A is the company itself, a regulator or a filing; tier B is trade or business press.

1. [1]minimus.ioMinimus · minimus.io · undated page, accessed November 5, 2026 · Tier A: the company, a regulator or a filing
2. [2]Meet Minimus | Innovators in Container and Cloud SecurityMinimus · undated page, accessed November 5, 2026 · Tier A: the company, a regulator or a filing
3. [3]CVE Reduction Calculator | Minimus Container SecurityMinimus · undated page, accessed November 10, 2026 · Tier A: the company, a regulator or a filing
4. [4]Free Hardened Container Images | MinimusMinimus · undated page, accessed November 10, 2026 · Tier A: the company, a regulator or a filing
5. [5]Build Faster with Hardened Images | How Minimus WorksMinimus · undated page, accessed November 10, 2026 · Tier A: the company, a regulator or a filing
6. [6]Zero CVEs - Minimus PlatformMinimus · undated page, accessed November 10, 2026 · Tier A: the company, a regulator or a filing
7. [7]Minimus Trust Center | SOC-2 & ISO 27001 Certified Security StandardsMinimus · undated page, accessed November 10, 2026 · Tier A: the company, a regulator or a filing
8. [8]Pricing Plans - Free & Enterprise | MinimusMinimus · undated page, accessed November 10, 2026 · Tier A: the company, a regulator or a filing

Last verified November 5, 2026. Our code found the quoted passage behind each fact on its source page when the fact was recorded, and re-checks every record against its sources each month.

Recorded November 5, 2026, expanded November 10, 2026 from the references above.

Work for Minimus? Suggest a correction to a fact on this page (with a source on your own domain), or claim this entry by publishing a small file on your domain.