Minimal vs Chainguard

Chainguard largely created this category, and Minimal is built on Wolfi and apko — their open-source work. This is not a claim to replace them. It is a measured answer to one specific question: if you want hardened images without a paid tier, what do you actually give up?

The honest framing

Chainguard's free tier publishes a limited set of images; the full catalog is commercial. When this scan ran on 2026-07-24, only 20 of Minimal's images had a free, publicly pullable Chainguard equivalent to compare against — so this table is narrow by construction, and that is the most important caveat on the page. The remaining images are marked not available, never scored as wins.

Across those 20 images Minimal totalled 16 unique CVEs against 29. Most rows are ties at or near zero, which is the honest headline: on the images where both are free, the two are broadly comparable.

Full head-to-head

Δ is Minimal minus Chainguard, so negative is better for Minimal.

What you give up, and what you gain

Chainguard details verified 2026-07-24 from their public documentation and by pulling from their free tier; they change often, so check for yourself rather than taking this table's word for it. Minimal's own column is checkable with the commands on the verify page.

When Chainguard is the right answer

If you need thousands of images, FedRAMP or STIG artifacts, SLSA Build L3, a vendor SLA, or CVE remediation someone is contractually obliged to deliver — buy the product. Minimal offers none of that, and pretending otherwise would be the kind of claim this project has already had to retract once.

Minimal fits when you want a catalog small enough to read end to end, every recipe in one MIT-licensed repo, at zero cost and with no account.

Trying it

docker pull ghcr.io/rtvkiz/minimal-python:latest
grype ghcr.io/rtvkiz/minimal-python:latest

How these numbers were produced

• Scanner: Grype 0.109.1, vulnerability DB schema v6.1.9, built 2026-07-23 07:03:49 UTC.
• DB checksum: 4089fed48894694510d7e5e2f7b9c261bc636eae459ae881f479a2e61c946046
• Platform: linux/amd64. Scan date: 2026-07-24.
• Production latest tags were resolved to immutable digests before scanning, so the run is repeatable.
• Every image was scanned with the same Grype binary and the same frozen database.
• Raw Grype findings. No vendor VEX suppression was applied to anyone, including us.
• Only publicly pullable images were scanned. No paid or private registry credentials were used.

The full 273-row dataset, including the resolved reference and digest for every provider/image pair, is here: cve-comparison-2026-07-24.csv. Every figure on this page is derived from that file.

What this does not prove

latest does not guarantee the same application version or feature set across vendors, so an individual outlier should be version- and feature-matched before it is treated as a product-level claim. A scanner reports known findings visible to one database snapshot; a low count is not proof that an image is free of vulnerabilities. An image a vendor does not publish is counted as not available — never as zero.