Minimal vs Minimus

Both projects ship small, hardened, low-CVE container images. This page is the measured comparison: 81 exact or same-major/minor version pairs, scanned with the same Grype binary against the same frozen database on 2026-10-15. Another 23available pairs have mismatched or unknown versions and are excluded from the score.

Summed across those 81 images, Minimal carries 215 unique CVEs against Minimus's 1089. That total is dominated by a handful of images on both sides, so the per-image table below matters more than the sum.

Where Minimal is worse

Leading with this because it is the part a vendor comparison normally hides. On1 of 81 images Minimal reports more unique CVEs than Minimus:

These are current scan observations, not permanent product properties. The complete raw dataset and version classifications are published below so each difference can be checked.

Full head-to-head

Every exact or same-major/minor version pair, best result first. Δ is Minimal minus Minimus, so negative is better for Minimal.

Minimus had 104 public equivalents in this run: 81 were version-matched and scored, while 23 were excluded for mismatched or unknown versions. Minimal also publishes 31 scanned images with no Minimus equivalent; those are excluded entirely rather than scored as wins.

The differences that are not CVE counts

Statements above describe Minimal, and each is checkable with the commands on theverify page. We deliberately do not characterise Minimus's pricing, licensing or roadmap here — those change, and their site is the authority on them.

Trying it

Pull any image and scan it yourself with the same tool used above:

docker pull ghcr.io/rtvkiz/minimal-python:latest
grype ghcr.io/rtvkiz/minimal-python:latest

Migrating an existing deployment? Seemigrating from Minimus to Minimal.

How these numbers were produced

• Scanner: Grype 0.109.1, vulnerability DB schema v6.1.10, built 2026-10-15T06:30:36Z.
• DB checksum: https://grype.anchore.io/databases/v6/vulnerability-db_v6.1.10_2026-10-15T00:29:08Z_1792045836.tar.zst?checksum=sha256%3A2f1597f25b5089e966272b251eb4d1f9977e59d57029af1c8810deb6e5321aa2
• Platform: linux/amd64. Scan date: 2026-10-15.
• Production latest tags were resolved to immutable digests before scanning, so the run is repeatable.
• Every image was scanned with the same Grype binary and the same frozen database.
• Raw Grype findings. No vendor VEX suppression was applied to anyone, including us.
• Only publicly pullable images were scanned. No paid or private registry credentials were used.
• Only exact or same-major/minor upstream version pairs are scored. Mismatched and unknown versions are excluded.

The full 540-row dataset, including the resolved reference and digest for every provider/image pair, is here: cve-comparison-2026-10-15.csv. The scored-pair inputs and version classifications are here:cve-comparison-pairs-2026-10-15.csv. Every figure on this page is derived from those files.

What this does not prove

Exact versions can still bundle different feature sets, and same-major/minor pairs can use different patch releases, so an individual outlier still needs inspection before it is treated as a product-level claim. A scanner reports known findings visible to one database snapshot; a low count is not proof that an image is free of vulnerabilities. An image a vendor does not publish is counted as not available — never as zero.