[HN Gopher] Show HN: Minimal - Open-Source Community driven Hard...
___________________________________________________________________
Show HN: Minimal - Open-Source Community driven Hardened Container
Images
I would like to share Minimal - Its a open source collection of
hardened container images build using Apko, Melange and Wolfi
packages. The images are build daily, checked for updates and
resolved as soon as fix is available in upstream source and Wolfi
package. It utilizes the power of available open source solutions
and contains commercially available images for free. Minimal
demonstrates that it is possible to build and maintain hardened
container images by ourselves. Minimal will add more images
support, and goal is to be community driven to add images as
required and fully customizable.
Author : ritvikarya98
Score : 40 points
Date : 2026-01-31 19:58 UTC (3 hours ago)
(HTM) web link (github.com)
(TXT) w3m dump (github.com)
| debarshri wrote:
| This is great. I have been talking to quite some vendors in the
| space. I have looked in docker hardened images too. They have
| made it free too.
|
| I think the problem in general is hardened image market is
| keeping up with CVEs and making sure the catalog is vast so that
| it covers all the images and nuances.
|
| Responding and patchibg CVEs with an SLA is the KPI of the
| vendors. As much as I would like cheer for you, doing it as an
| opensource initiate with a guaranteed SLA is going to be painful
| for you as maintainer without profit as a motive.
| ritvikarya98 wrote:
| Thanks for looking into this! I agree with you and hence I'm
| also relying on Wolfi packages, which will ensure they are
| updated as soon as upstream is available so I'm piggy backing
| on that. Github Actions run daily/weekly based on the cadence
| and once the pipeline is setup do not require a significant
| effort imo. And I want it to be community driven so we can add
| images as and when people want it and build it accordingly.
| Chainguard tools surely help with this! I aim to show that
| companies can try and build internal pipelines like this for
| all images in their repository
| hobofan wrote:
| Isn't this mostly the same thing that Chainguard already
| provides themselves? E.g. the "Free" images on their page [0]
| have a big overlap with the toolchains from your repo.
|
| [0]: https://images.chainguard.dev
| ritvikarya98 wrote:
| Some images do overlap yes, but they are some of the most
| popular ones used and I wanted to demonstrate how they can
| be build as well. Half of them are only available through
| paid versions. I will be adding new images on regular
| basis, based on usage and impact.
| anukritisingh wrote:
| Looks very useful, we should definitely build up on this!!!
| Joel_Mckay wrote:
| Hard pass...
|
| In general, a public security policy is pointless. It is the
| one layer you want people to trip over when breaking a system.
| =3
| tigerinthe wrote:
| Why do you say so?
| Joel_Mckay wrote:
| Best to look at security policy using ecological predator-
| prey models. If you don't, than you fall victim to the
| assumption a "puzzle" you can't break is unbreakable in
| general.
|
| Nuisance users don't publish CVE, and a zero trust model
| shows you something important. =3
| adriand wrote:
| Dumb question but how would these work in practice? I use kamal
| to deploy containerized applications. Would I on a regular basis
| update the versions of the underlying images to match the latest
| hardened container and then redeploy? I assume this is
| automatable?
| humayuuun wrote:
| Need more information on how I can integrate this in my pipeline
| but this looks promising
| Dayshine wrote:
| Why does this not use chisel? I assume you at least drop the bin
| dir? Although the presence of ncurses is super weird
|
| I don't understand why one would go halfway and leave packages
| which are unneeded for services. The only executable in a
| hardened container image should be your application.
___________________________________________________________________
(page generated 2026-01-31 23:00 UTC)