The official Python image on Docker Hub, pulled fresh today, ships with more than 400 known vulnerabilities before a developer writes a single line of application code. Roughly 100 of them are high or critical severity. John Morello, CTO and co-founder of container security startup Minimus, says that’s not a fluke; it’s structural. Public registry images are built for developer convenience, not security, bundling shells, debugging tools, and dependencies that only get updated when the core project itself ships a new version, not when a bundled library like glibc or OpenSSL gets patched separately.
Minimus’s fix is to rebuild the entire dependency chain from scratch every day: tens of thousands of individual open source components, compiled directly from upstream source, then assembled into images containing only what’s actually required to run. The Python image that ships at 400MB from official channels comes out of Minimus’s pipeline at around 23MB, roughly a twentieth the size, with 98 to 100% fewer vulnerabilities on average. Most of the images in Minimus’s catalog, which the company opened for free with no signup required in June, show zero known vulnerabilities at all; the rare exception is simply something that hasn’t been patched upstream yet.
For most teams, Morello said, migrating is a one-line change to a Dockerfile’s FROM statement, and Minimus even ships a long, pre-tested prompt customers can hand to their own coding agent to automate the swap across multiple repositories at once. The tradeoff shows up mainly for teams in the habit of exec-ing into a running container to install or debug something on the fly, since Minimus’s stripped-down images assume that’s not the workflow; a developer-focused image variant covers that case. For everyone else, Morello argues there’s no real downside: it’s the same upstream software, just newer, smaller, and with far less surface area for something to go wrong. Customers who swap in Minimus images routinely go from tens of thousands of flagged vulnerabilities in a Kubernetes environment down to a small handful almost immediately.
##
ABOUT THE AUTHOR
Tom Smith is a technology writer and content strategist with more than 10 years of experience covering enterprise technology, agentic AI, cybersecurity, DevOps, and cloud infrastructure. He has published more than 2,500 articles and conducted more than 4,000 executive interviews across outlets including Coder Legion, Techstrong/DevOps.com, and Insights From Analytics. By day, Tom serves as a content strategist at Cognizant. He can be found on LinkedIn, X, and Bluesky at @ctsmithiii.
