minimal

Minimal vs Docker Hardened Images

This is the comparison where Minimal has the weakest case, so it is worth being direct about it rather than burying the fact.

What changed in December 2025

Docker made over 1,000 hardened images free under an Apache-2.0 licence, pullable without an account. Paid tiers remain for SLA-backed critical-CVE remediation, FIPS compliance, DoD STIG artifacts and extended lifecycle support beyond upstream EOL.

That removes “free hardened images” as a differentiator for anyone. It is a genuinely good outcome for the ecosystem, and it means the reason to use this project has to be something other than price.

Where Docker is the better choice

  • Breadth. 1,000+ images against 108. If your stack is not fully covered here — and the directory is the place to check — that ends the discussion.
  • Compliance evidence. FIPS validation and STIG artifacts are things Minimal does not produce and has no path to producing.
  • Remediation you can hold someone to. A contractual fix window for critical CVEs. Here you have a 6-hour rebuild cadence and no obligation behind it.
  • Lifecycle support. Paid coverage for software past upstream EOL. Minimal follows upstream and stops when upstream stops.
  • SLSA Build L3. Minimal publishes Build L2 and says so.

Where Minimal still has a case

  • You can read the whole thing. 108 images, every build recipe MIT-licensed in one repo. Auditing a catalog this size end to end is a day's work, not a project.
  • No vendor in the loop. Not a free tier of a commercial product with a pricing page attached — there is no paid tier to be moved onto, and MIT recipes mean you can fork and self-host the whole pipeline if the project stops.
  • Modifiable by design. The point is partly that you can take the melange and apko recipes and build your own catalog with your own controls. Docker's images are Apache-2.0 too, but the pipeline that produces them is not the product.
  • Published comparison data. Scan results against other providers with the raw dataset and the losing rows included — see Minimus and Chainguard.

What we have not measured

There is no head-to-head scan comparison against Docker Hardened Images on this site yet. The published dataset covers Minimus and publicly pullable Chainguard images only, and adding a provider means re-running the whole scan with the same frozen database rather than quoting figures from different days. Until that runs, this page makes no claim about relative CVE counts in either direction.

Honest summary

If you want a supported catalog that covers everything, use Docker's — it is free, it is Apache-2.0, and it is broader than this will ever be. Use Minimal if you specifically want a small catalog you can audit completely, recipes you can fork, and no vendor relationship at all. Those are narrower reasons than “it's free”, and they are the real ones. 

docker pull ghcr.io/rtvkiz/minimal-python:latest
grype ghcr.io/rtvkiz/minimal-python:latest

Docker's announcement and current terms are the authority on what Docker Hardened Images include; details change, so check docker.com/products/hardened-images rather than this page. Claims about Minimal are checkable from the verify page. Last reviewed 2026-09-01.