Minimus is shutting down, and its registry (reg.mini.dev) goes dark on October 22, 2026, following a 60-day maintenance period that started August 24. Pulled images keep working, but there will be no new updates. If you run Minimus images, you have a migration deadline.
Even before this, its model didn't work for everyone. Adopting Minimus meant moving onto its images, which were built on its own distro (MinimOS), and relying on its release cadence. And because the images are distroless (no shell or package manager), anything your setup relied on that Minimus stripped out had to be reworked.
There are alternatives that avoid this. Instead of moving you onto a vendor distro, they patch the base image you already run, and where you've pinned a version, they backport fixes into it rather than forcing you forward. This post covers where to go next.
This post covers where to go next, and what to look for so you're not migrating again in a year. We compare:
- Aikido Security
- Chainguard
- Docker Hardened Images
- RapidFort
- Echo
TL;DR
Our top pick is Aikido Security. Instead of migrating you onto a new distribution, it patches the base image you already run, so nothing breaks, and the fix lands as a pull request you merge once. After that, Aikido keeps rebuilding the image as new vulnerabilities are patched and alerts you when a newer build is available. Every image is a drop-in replacement with an SBOM, VEX, and SLSA provenance, covering OS-level CVEs under a defined patch-creation SLA. It keeps patching versions even after end-of-life, and it sits inside a platform that also covers SAST, DAST, SCA, secrets detection, and cloud posture. Having already migrated Root's customers, Aikido can move you off Minimus the same way.
{{cta}}
What Minimus did well
Minimus built its distroless images from source on its own distro, MinimOS, carrying only what an app needed to run and none of the shell and package-manager tooling that widens the attack surface. The catalog ran to over 1,200 images with FIPS, CIS, NIST, and STIG baselines, and in June 2026 the whole thing went free with no registration. For images that fit as-is, adoption was a single-line change to a Dockerfile or manifest.
Why you need a Minimus alternative now
The Minimus catalog is shutting down and there will be no more updates to Minimus images after October 22. Anything you've pulled keeps running, but the CVEs will pile up with no patched replacement coming.
If you want to keep your images free of vulnerabilities, you are now being forced to perform a costly migration off Minimus. Getting off means swapping every Minimus image hosting one of your services for another source and re-testing. The migration itself is unavoidable now, so it's worth choosing a replacement that doesn't lock you onto its own distro and cadence, or you'll be doing this again the next time a vendor changes course.
And even if you were fine migrating onto its distro, the model was brittle. Minimus rebuilt images from upstream and shipped new releases, so even when the version number didn't change, a patched image meant a new digest. Staying current meant rolling forward to each one, and every roll-forward was a fresh image to test and re-approve.
Rolling forward worked fine until it didn't. For example, a CVE hit a library in your image and the fix shipped in version 2.1, but another package you depended on only accepted versions below 2.0. The sensible move was to pin that dependency to an exact version, but then you couldn't upgrade out, and the image just accumulated vulnerabilities.
What to look for in a Minimus alternative
- A large ready-made catalog: How many of the bases you actually run does it already cover? Look for real breadth across Debian, Ubuntu, and Alpine, on both amd64 and arm64.
- Verifiable provenance: A signed SBOM, a VEX document, and SLSA provenance attached to every pull, so you can prove what's in an image and how it was built.
- Security past end-of-life: Patching that continues after the upstream distro moves on, so you can hold an older base without carrying its known critical and high CVEs.
- Coverage past the base image: Look for a tool that also reaches your dependencies, code (SAST), IaC, secrets, and runtime, so a finding arrives with the context around it.
- Compliance evidence by default: FIPS, CIS, NIST, and STIG baselines with the audit artifacts generated automatically.
- A vendor whose runway you can count on: Weigh backing, track record, and how much you'd lose if it happened again.
Top Minimus alternatives
Aikido Security
Where Minimus moved you onto its own distro, Aikido patches the base image you already run. Aikido Images is a registry of 2,000+ drop-in replacements where the known critical and high vulnerabilities in the base are already patched. Those images are rebuilt, patched, minimized, and hardened during the build, so you get the full treatment, a smaller attack surface and locked-down defaults, on the base you already run.
For example, debian:bookworm ships a patched glib2.0 for CVE-2025-4373, which Debian fixed in Trixie and Sid but not Bookworm. The Aikido Images variant of debian:bookworm carries the patched glib2.0 that closes it.
Because the swap is a drop-in that AutoFix proposes as a pull request, the fix lands the moment you merge, and every pull from docker.aikido.io arrives with an SBOM, VEX, and SLSA provenance. Aikido keeps patching versions after upstream has moved away, even ones that have hit end-of-life, so you can stay on an older base without carrying its known security flaws and without being pushed onto a newer version to stay covered.
The team behind these images joined through Aikido's acquisition of Root, the company behind SlimToolkit (formerly DockerSlim), one of the most widely used open source image-hardening tools, with over 23,000 GitHub stars and a documented ability to minify images by up to 30x. Root's existing customers were migrated onto Aikido Images and Libraries, and Aikido can move you off Minimus the same way.
Aikido has raised $85M and is relied on by 150,000+ teams, including enterprises like Revolut, Belfius, the Premier League, Deel, and SoundCloud, along with Visma, which runs Aikido across 200-plus portfolio companies and 6,000 developers. A company liquid enough to acquire Root outright is not the one about to turn its registry off.
A growing share of real fixes never get a CVE at all. Aikido's ongoing monitoring is fed in part by Aikido Intel, which reads upstream changelogs and commit history to catch vulnerabilities that were silently patched without one. And where most of these tools remediate a CVE by upgrading the affected package to a newer release, Aikido makes the heaviest use of backported patches, taking the fix from the newer version and applying it to the version you already run. That keeps the change small, so the image is likelier to behave the way your app expects, with less of the upgrade debt that piles up when you're pushed onto new versions.
When a clean backport isn't possible, Aikido upgrades or rebuilds the component instead. It also maps every container to the base it inherits and points you at the swap that removes the most risk across the org, with 100+ patches researched and tested daily and OS-level coverage under a defined patch-creation SLA.
Application-level package vulnerabilities across ecosystems like npm, PyPI, Maven, and Go are patched in place through Aikido Libraries. All of it sits inside a mature software security platform that also covers SAST, DAST, SCA, secrets detection, cloud posture, and container image scanning, so an image finding shows up with the code and cloud context around it.
Best for: teams that want vulnerabilities cleared out of the base images and dependencies they already run, without migrating to a vendor distribution.
{{walkthrough}}
Chainguard
Chainguard strips an image down and rebuilds it from Wolfi, its own Linux distribution. It ships every image with a signed SBOM and Sigstore signatures, and publishes a remediation SLA of 7 days for critical CVEs and 14 for everything else. There are federal-grade options too, with FIPS-validated variants and DISA STIG hardening.
The cost is migration and lock-in. Adopting Chainguard means moving your services onto its catalog and Wolfi, and if your app relied on something Chainguard stripped out, it breaks. The model keeps you rolling forward, so every fix lands as a new digest you re-test and re-approve, and pinning to a digest for reproducibility stops the patches reaching you at all.
Chainguard also ages older versions out fast. Non-latest packages are kept around 12 months, and its end-of-life grace period runs six months, covers only the dependency packages under an image rather than the primary component, and sits outside the normal CVE SLA. Anything pulled from the general Wolfi OSS repository falls outside the SLA, the FIPS commitment doesn't extend to custom builds, and Chainguard doesn't tell you what's in an image at the CVE level, so its own docs point you to Trivy, Grype, Snyk, or Docker Scout to scan.
Best for: Teams that can commit to a single vendor's distribution and cadence. Not for teams that need to hold a base or a version steady without constant re-testing.
For a closer look, see our full list of Chainguard alternatives.
Docker Hardened Images
Docker's hardened catalog launched in May 2025 and became free and open source under Apache 2.0 in December 2025. DHI is worth considering for teams already on Docker Hub. It aims to provide near-zero CVE images on standard Alpine and Debian foundations, with no proprietary distro to adopt, and ships signed SBOMs and VEX attestations. DHI Select adds a 7-day critical CVE SLA plus FIPS and STIG variants, and DHI Enterprise adds customization with extended lifecycle support for up to five years past upstream end-of-life.
The catalog is newer and shallower than the established players, so the track record under heavily regulated workloads is shorter and a hardened version of your exact base isn't guaranteed. Coverage also stops at the image, with nothing for your code, dependencies, IaC, or secrets. And DHI remediates by rolling forward. A fix arrives as a new version or digest you re-test, and pinning for stability holds the patch back.
Best for: Teams already on Docker Hub who want hardened images and don't need FIPS, STIG, or an SLA, which sit behind the paid tiers. Not for teams whose exact base isn't in Docker's still-shallow catalog.
RapidFort
RapidFort offers a catalog of hardened images built on standard LTS distributions like Alpine, Debian, Ubuntu, and Red Hat rather than a proprietary distro. The lineup is oriented toward federal and defense work, with FIPS validation and STIG and CIS hardening. On top of the catalog, RapidFort adds runtime profiling, watching which packages and binaries actually execute in production and stripping out whatever it didn't see run.
That profiling is also the catch. It only keeps what it observes, so code that doesn't fire during the profiling window can get stripped and then fail when it finally runs in production. Profiles go stale when the app or its traffic changes, so any meaningful change means re-profiling and re-testing before you ship. And like the others here, coverage stops at the image, with nothing above it for your code, dependencies, or cloud.
Best for: Federal contractors, defense vendors, and regulated teams already committed to FIPS and STIG compliance, but teams reaching for the deeper runtime-profiling optimization should know it's brittle and needs re-profiling every time the app changes.
Echo
Echo is a newer entrant pitching an AI-driven image factory that compiles images from source, including only the components an app needs, with agents that watch vulnerability feeds and regenerate images as CVEs land upstream. The images aim for zero CVEs, ship as drop-in replacements for standard Docker bases, and come FIPS-validated and STIG-aligned for teams that need it.
The main question is maturity. Echo is a Series A company with a short operational history, so the rebuild-and-patch pipeline is the least proven of the group under regulated, production-scale workloads, and the catalog is smaller, so coverage for less common workloads may be thinner. As with the rest of this list, it remediates by shipping a new image rather than patching the version you run, and coverage stops at the image.
Best for: Teams that want a source-built base image strategy and can carry the risk of a Series A vendor with a short track record running the pipeline their images depend on.
FAQ
<script type="application/ld+json">
{
"@context": "https://schema.org",
"@graph": [
{
"@type": ["BlogPosting", "TechArticle"],
"@id": "https://www.aikido.dev/blog/top-minimus-alternatives#article",
"isPartOf": { "@id": "https://www.aikido.dev/blog/top-minimus-alternatives#webpage" },
"mainEntityOfPage": { "@id": "https://www.aikido.dev/blog/top-minimus-alternatives#webpage" },
"headline": "Top Minimus alternatives in 2026",
"description": "Minimus is shutting down on October 22, 2026. Compare the top Minimus alternatives for hardened container images, including Aikido Security, Chainguard, Docker Hardened Images, RapidFort, and Echo, and learn what to look for so you don't migrate again.",
"abstract": "A comparison of the best Minimus alternatives for hardened container images following the Minimus shutdown, covering migration cost, backporting, distro lock-in, and coverage beyond the base image.",
"inLanguage": "en-US",
"datePublished": "2026-08-26",
"dateModified": "2026-08-26",
"wordCount": 1700,
"timeRequired": "PT8M",
"author": { "@id": "https://www.aikido.dev/authors/nicholas-thomson#person" },
"editor": { "@id": "https://www.aikido.dev/authors/nicholas-thomson#person" },
"creator": { "@id": "https://www.aikido.dev/authors/nicholas-thomson#person" },
"publisher": { "@id": "https://www.aikido.dev#organization" },
"image": { "@id": "https://www.aikido.dev/blog/top-minimus-alternatives#primaryimage" },
"thumbnailUrl": "https://www.aikido.dev/images/blog/top-minimus-alternatives.png",
"articleSection": "DevSec Tools & Comparisons",
"keywords": [
"Minimus alternatives",
"Minimus shutdown",
"hardened container images",
"distroless images",
"container image security",
"CVE backporting",
"base image patching",
"Chainguard alternative",
"Docker Hardened Images",
"RapidFort",
"Echo images",
"Aikido Security",
"container vulnerability management",
"FIPS STIG container images",
"software supply chain security"
],
"about": [
{ "@id": "https://www.aikido.dev/blog/top-minimus-alternatives#term-hardened-image" },
{ "@id": "https://www.aikido.dev/blog/top-minimus-alternatives#term-distroless" },
{ "@id": "https://www.aikido.dev/blog/top-minimus-alternatives#term-backporting" },
{ "@type": "Thing", "name": "Container image security" },
{ "@type": "Thing", "name": "Software supply chain security" }
],
"mentions": [
{ "@type": "SoftwareApplication", "name": "Aikido Security", "applicationCategory": "SecurityApplication", "operatingSystem": "Cross-platform", "url": "https://www.aikido.dev" },
{ "@type": "SoftwareApplication", "name": "Minimus", "applicationCategory": "SecurityApplication", "operatingSystem": "Linux", "url": "https://www.minimus.io" },
{ "@type": "SoftwareApplication", "name": "Chainguard", "applicationCategory": "SecurityApplication", "operatingSystem": "Linux", "url": "https://www.chainguard.dev" },
{ "@type": "SoftwareApplication", "name": "Docker Hardened Images", "applicationCategory": "SecurityApplication", "operatingSystem": "Linux", "url": "https://www.docker.com/products/hardened-images/" },
{ "@type": "SoftwareApplication", "name": "RapidFort", "applicationCategory": "SecurityApplication", "operatingSystem": "Linux", "url": "https://www.rapidfort.com" },
{ "@type": "SoftwareApplication", "name": "Echo", "applicationCategory": "SecurityApplication", "operatingSystem": "Linux", "url": "https://www.echohq.com" },
{ "@type": "Thing", "name": "Wolfi Linux distribution" },
{ "@type": "Thing", "name": "MinimOS" },
{ "@type": "Thing", "name": "SBOM (Software Bill of Materials)" },
{ "@type": "Thing", "name": "VEX (Vulnerability Exploitability eXchange)" },
{ "@type": "Thing", "name": "SLSA provenance" },
{ "@type": "Thing", "name": "FIPS" },
{ "@type": "Thing", "name": "DISA STIG" },
{ "@type": "Thing", "name": "CVE-2025-4373" }
],
"speakable": {
"@type": "SpeakableSpecification",
"cssSelector": ["h1", "h2"]
}
},
{
"@type": ["WebPage", "CollectionPage"],
"@id": "https://www.aikido.dev/blog/top-minimus-alternatives#webpage",
"url": "https://www.aikido.dev/blog/top-minimus-alternatives",
"name": "Top Minimus alternatives in 2026",
"isPartOf": { "@id": "https://www.aikido.dev#website" },
"primaryImageOfPage": { "@id": "https://www.aikido.dev/blog/top-minimus-alternatives#primaryimage" },
"image": { "@id": "https://www.aikido.dev/blog/top-minimus-alternatives#primaryimage" },
"datePublished": "2026-08-26",
"dateModified": "2026-08-26",
"inLanguage": "en-US",
"breadcrumb": { "@id": "https://www.aikido.dev/blog/top-minimus-alternatives#breadcrumb" },
"mainEntity": { "@id": "https://www.aikido.dev/blog/top-minimus-alternatives#itemlist" },
"significantLink": [
"https://www.aikido.dev/cloud/hardened-images",
"https://www.aikido.dev/code/autofix",
"https://www.aikido.dev/code/aikido-libraries"
],
"speakable": {
"@type": "SpeakableSpecification",
"cssSelector": ["h1", "h2"]
}
},
{
"@type": "WebSite",
"@id": "https://www.aikido.dev#website",
"url": "https://www.aikido.dev",
"name": "Aikido Security",
"publisher": { "@id": "https://www.aikido.dev#organization" },
"inLanguage": "en-US"
},
{
"@type": "ImageObject",
"@id": "https://www.aikido.dev/blog/top-minimus-alternatives#primaryimage",
"url": "https://www.aikido.dev/images/blog/top-minimus-alternatives.png",
"contentUrl": "https://www.aikido.dev/images/blog/top-minimus-alternatives.png",
"caption": "Top Minimus alternatives in 2026",
"width": 1200,
"height": 630
},
{
"@type": "BreadcrumbList",
"@id": "https://www.aikido.dev/blog/top-minimus-alternatives#breadcrumb",
"itemListElement": [
{ "@type": "ListItem", "position": 1, "name": "Home", "item": "https://www.aikido.dev" },
{ "@type": "ListItem", "position": 2, "name": "Blog", "item": "https://www.aikido.dev/blog" },
{ "@type": "ListItem", "position": 3, "name": "Top Minimus alternatives in 2026", "item": "https://www.aikido.dev/blog/top-minimus-alternatives" }
]
},
{
"@type": "ItemList",
"@id": "https://www.aikido.dev/blog/top-minimus-alternatives#itemlist",
"name": "Top Minimus alternatives in 2026",
"description": "Ranked hardened container image tools to replace Minimus.",
"numberOfItems": 5,
"itemListOrder": "https://schema.org/ItemListOrderDescending",
"itemListElement": [
{
"@type": "ListItem",
"position": 1,
"name": "Aikido Security",
"url": "https://www.aikido.dev/cloud/hardened-images",
"item": {
"@type": "SoftwareApplication",
"name": "Aikido Security",
"applicationCategory": "SecurityApplication",
"operatingSystem": "Cross-platform",
"url": "https://www.aikido.dev",
"description": "Patches the base image you already run, backporting critical and high CVE fixes into your pinned version and delivering the swap as an AutoFix pull request, inside a software security platform that also covers SAST, DAST, SCA, secrets detection, and cloud posture."
}
},
{
"@type": "ListItem",
"position": 2,
"name": "Chainguard",
"url": "https://www.chainguard.dev",
"item": {
"@type": "SoftwareApplication",
"name": "Chainguard",
"applicationCategory": "SecurityApplication",
"operatingSystem": "Linux",
"url": "https://www.chainguard.dev",
"description": "Hardened images rebuilt from source on Wolfi, its own Linux distribution, with a published CVE remediation SLA and FIPS and STIG options, requiring migration onto its distribution."
}
},
{
"@type": "ListItem",
"position": 3,
"name": "Docker Hardened Images",
"url": "https://www.docker.com/products/hardened-images/",
"item": {
"@type": "SoftwareApplication",
"name": "Docker Hardened Images",
"applicationCategory": "SecurityApplication",
"operatingSystem": "Linux",
"url": "https://www.docker.com/products/hardened-images/",
"description": "Near-zero CVE images built on standard Alpine and Debian foundations, free under Apache 2.0, with FIPS, STIG, and SLA options behind paid tiers."
}
},
{
"@type": "ListItem",
"position": 4,
"name": "RapidFort",
"url": "https://www.rapidfort.com",
"item": {
"@type": "SoftwareApplication",
"name": "RapidFort",
"applicationCategory": "SecurityApplication",
"operatingSystem": "Linux",
"url": "https://www.rapidfort.com",
"description": "Curated hardened images on standard LTS distributions plus runtime profiling that strips unused components, oriented toward federal and defense workloads with FIPS and STIG hardening."
}
},
{
"@type": "ListItem",
"position": 5,
"name": "Echo",
"url": "https://www.echohq.com",
"item": {
"@type": "SoftwareApplication",
"name": "Echo",
"applicationCategory": "SecurityApplication",
"operatingSystem": "Linux",
"url": "https://www.echohq.com",
"description": "An AI-driven image factory that compiles images from source as drop-in replacements for standard Docker bases, FIPS-validated and STIG-aligned, from an early-stage vendor."
}
}
]
},
{
"@type": "FAQPage",
"@id": "https://www.aikido.dev/blog/top-minimus-alternatives#faq",
"isPartOf": { "@id": "https://www.aikido.dev/blog/top-minimus-alternatives#webpage" },
"mainEntity": [
{
"@type": "Question",
"name": "What happens to my Minimus images after October 22, 2026?",
"acceptedAnswer": {
"@type": "Answer",
"text": "Anything you've already pulled keeps running. The registry (reg.mini.dev) goes offline, so you can't pull new or updated images after that date, and no further patches ship. The images you're running freeze exactly as they are."
}
},
{
"@type": "Question",
"name": "Are my frozen Minimus images still safe to run?",
"acceptedAnswer": {
"@type": "Answer",
"text": "They work, but they stop getting fixes. As new CVEs are found in the packages inside them, nothing patches those, so the known-vulnerability count on a frozen image only grows. That's the reason to plan a move rather than sit on what you have."
}
},
{
"@type": "Question",
"name": "Do I have to migrate to a new distro to replace Minimus?",
"acceptedAnswer": {
"@type": "Answer",
"text": "No. That's the main thing to check in a replacement. Some options (Chainguard on Wolfi, and Minimus itself) put you on a vendor distro. Others, like Aikido, patch the base you already run, so you stay on the same distribution and major version and skip the re-platform."
}
},
{
"@type": "Question",
"name": "Will switching off Minimus break my app?",
"acceptedAnswer": {
"@type": "Answer",
"text": "It depends on the replacement. Moving onto a different vendor's rebuilt images means re-testing for anything they've stripped that you relied on. Staying on a patched build of your existing base is lower risk, since the distribution, package layout, and behavior are the same and only the fixed CVEs change."
}
},
{
"@type": "Question",
"name": "What happens when the upstream distro never patches my version?",
"acceptedAnswer": {
"@type": "Answer",
"text": "This is common with pinned or older bases. The fix lands in a newer release, not the one you run. A tool that backports takes that fix and applies it to your version, so you clear the CVE without a forced upgrade. A roll-forward tool can't help here, since its only answer is to move you to the newer release."
}
},
{
"@type": "Question",
"name": "Do I still need a scanner if I use hardened images?",
"acceptedAnswer": {
"@type": "Answer",
"text": "Yes. Hardened images lower the count of inherited CVEs, but they don't hit zero, and nothing about a hardened base covers your application code, dependencies, IaC, or secrets. You still need something watching what's actually in the image over time and the layers above it."
}
}
]
},
{
"@type": "DefinedTerm",
"@id": "https://www.aikido.dev/blog/top-minimus-alternatives#term-hardened-image",
"name": "Hardened container image",
"description": "A minimal container image whose remaining packages are patched to current versions and locked down with secure defaults, non-root execution, and ongoing updates as new vulnerabilities appear."
},
{
"@type": "DefinedTerm",
"@id": "https://www.aikido.dev/blog/top-minimus-alternatives#term-distroless",
"name": "Distroless image",
"description": "A container image that contains only an application and its runtime dependencies, with no shell, package manager, or other operating-system utilities, reducing attack surface."
},
{
"@type": "DefinedTerm",
"@id": "https://www.aikido.dev/blog/top-minimus-alternatives#term-backporting",
"name": "Backporting",
"description": "Taking a security fix from a newer release of a package and applying it to the older version you already run, so a CVE is resolved without a forced major-version upgrade."
},
{
"@type": "Person",
"@id": "https://www.aikido.dev/authors/nicholas-thomson#person",
"name": "Nicholas Thomson",
"url": "https://www.aikido.dev/authors/nicholas-thomson",
"jobTitle": "Senior SEO & Growth Lead",
"worksFor": { "@id": "https://www.aikido.dev#organization" },
"sameAs": [
"https://www.linkedin.com/in/nicholas-gray-thomson/",
"https://x.com/"
]
},
{
"@type": "Organization",
"@id": "https://www.aikido.dev#organization",
"name": "Aikido Security",
"url": "https://www.aikido.dev",
"logo": {
"@type": "ImageObject",
"url": "https://www.aikido.dev/logo.png",
"width": 512,
"height": 512
},
"sameAs": [
"https://www.linkedin.com/company/aikido-security",
"https://x.com/AikidoSecurity",
"https://github.com/AikidoSec"
]
}
]
}
</script>
