Minimal vs Google distroless
distroless (gcr.io/distroless/*) is not a competing catalog — it ships a handful of bare language runtimes meant as a base layer for your own image, not a full set of databases, proxies and apps. This page only compares the images where both projects actually publish something: Python, Java and Node.js runtimes.
The honest framing
distroless publishes 3 images with a direct Minimal equivalent — Python, Java and Node.js bare runtimes. Of those, 0 were exact or same-major/minor version pairs and were scored; 3 mismatched or unknown-version pairs were excluded. Most comparisons here come down to upstream version lag rather than a meaningful hardening difference — distroless images often ship an older major of the runtime than Minimal's daily-rebuilt pin, which is a version-currency question, not a vulnerability-count one.
Full head-to-head
Exact and same-major/minor version pairs only. Δ is Minimal minus distroless, so negative is better for Minimal.
| Image | Minimal | distroless | Δ | Minimal crit/high | distroless crit/high |
|---|
How these numbers were produced
- Scanner: Grype 0.109.1, vulnerability DB schema v6.1.10, built 2026-10-15T06:30:36Z.
- DB checksum:
https://grype.anchore.io/databases/v6/vulnerability-db_v6.1.10_2026-10-15T00:29:08Z_1792045836.tar.zst?checksum=sha256%3A2f1597f25b5089e966272b251eb4d1f9977e59d57029af1c8810deb6e5321aa2 - Platform:
linux/amd64. Scan date: 2026-10-15. - Production
latesttags were resolved to immutable digests before scanning, so the run is repeatable. - Every image was scanned with the same Grype binary and the same frozen database.
- Raw Grype findings. No vendor VEX suppression was applied to anyone, including us.
- Only publicly pullable images were scanned. No paid or private registry credentials were used.
- Only exact or same-major/minor upstream version pairs are scored. Mismatched and unknown versions are excluded.
The full 540-row dataset, including the resolved reference and digest for every provider/image pair, is here: cve-comparison-2026-10-15.csv. The scored-pair inputs and version classifications are here:cve-comparison-pairs-2026-10-15.csv. Every figure on this page is derived from those files.
What this does not prove
Exact versions can still bundle different feature sets, and same-major/minor pairs can use different patch releases, so an individual outlier still needs inspection before it is treated as a product-level claim. A scanner reports known findings visible to one database snapshot; a low count is not proof that an image is free of vulnerabilities. An image a vendor does not publish is counted as not available — never as zero.
Where distroless and Minimal differ
| Minimal | distroless | |
|---|---|---|
| Scope | Full catalog of apps, databases, proxies and runtimes | Base runtime layers only — you build your app on top |
| Shell / package manager | No | No (on the non-debug tags) |
| Maintainer | Independent, MIT, one repo | Google, Apache-2.0 |
| Rebuild cadence | Every 6 hours | Not published as a fixed SLA |
| Signing / SBOM / provenance | Cosign-signed, SBOM-attested, SLSA v1.0 Build L2 | Varies by image; not uniformly published |
When distroless is the right answer
If you are building your own application image and only need a Python, Java, Node, C or static-binary base layer — not a pre-built database, proxy or application — distroless is a well-established, Google-maintained choice with broad ecosystem familiarity.
Minimal fits when you want the full application already built and hardened — a Postgres, a Redis, an nginx — not just the runtime underneath one, with a small enough catalog to audit end to end and no vendor in the loop.
Trying it
docker pull ghcr.io/rtvkiz/minimal-python:latest
grype ghcr.io/rtvkiz/minimal-python:latest