NIST SP 800-190 Container Security | Minimus Use Case

Minimus is ending operations. We appreciate the support of our many customers globally and are proud to have served you. Unfortunately, the current business and investment climate has resulted in a situation in which we are unable to continue operations. We acknowledge the effort that transitioning from our images will require and we are committed to providing customers with a stable transition period.
Beginning on Monday 24 August 2026, we will begin a 60 day maintenance period for the product and images. During this period, we will make necessary bug fixes to the overall product, provide commercial support, and continue to maintain images with upstream updates. On Thursday 22 October 2026, we will cease operations and turn off the Minimus registry (reg.mini.dev). Images pulled from the registry prior to 22 October will, of course, continue to function, but no further updated images will be provided.
For Enterprise Edition customers, we are committed to ensuring a fair and orderly conclusion to our commercial relationships. We will reach out to each Enterprise Edition customer individually, beginning on 24 August, to discuss the structured termination of your agreement, including any applicable refunds for the remaining contract period beyond 22 October.
While this is not the outcome that any of us wanted, we hope that this approach provides customers with ample opportunity to smoothly transition.
Ben, Dima, and John (Minimus Founders)
Engineering Foundations
Minimus was engineered from the ground up to address the complex security requirements outlined in NIST SP 800-190 (Application Container Security Guide), a foundational guide co-authored by one of the company's founders.
Our approach delivers a new category of container images that are inherently minimal, cryptographically verifiable, and functionally optimized for critical federal cybersecurity mandates.
Strategic Risk Mitigation
This integration moves beyond standard best practices by focusing on technical mechanisms that dramatically reduce operational risk and accelerate compliance, particularly in restricted environments.
Every Minimus image is engineered to eliminate extraneous components, such as shells and non-essential binaries. This drastically reduces the attack surface, directly aligning with the principle of least functionality and minimizing exposure to vulnerability chains.
All images are built with SLSA compliance principles, featuring cryptographically signed provenance records that are verifiably reproducible from source code to registry. This mitigates supply chain threats, ensures non-repudiation of build artifacts, and satisfies rigorous control objectives for software integrity.
We embed curated, real-time threat intelligence feeds and built-in action providers that automatically surface precise remediation steps within CI/CD and runtime tooling. This capability significantly accelerates vulnerability detection, patch deployment, and compliance drift correction.
Minimus images are optimized for seamless, secure deployment in air-gapped, classified enclaves, and other disconnected environments. This includes full, verifiable support for offline image mirroring, patch delivery, and policy enforcement without dependence on public cloud connectivity, making it critical for defense and intelligence use cases.
Images are configured by default to conform with baseline security standards such as FedRAMP, DoD SRG, and CIS Benchmarks. This pre-hardening minimizes configuration drift and significantly reduces the manual effort required by development and security teams to meet regulatory mandates.
The Minimus image pipeline generates a comprehensive Minimus NIST Report with every image build. This report provides granular compliance evidence against the NIST SP 800-190 Section 3.1 Benchmark, detailing the pass/fail status for every relevant NIST ID and including explanatory notes. This automated, verifiable reporting provides customers with a definitive, auditable compliance artifact, dramatically reducing the burden of manual assurance.