3 ms·

If you’re looking for an alternative here, we (the team that built Twistlock) launched Minimus a few months ago to provide near zero CVE images built continuous

If you’re looking for an alternative here, we (the team that built Twistlock) launched Minimus a few months ago to provide near zero CVE images built continuously from source. We have long experience in this space (we even wrote NIST SP 800-190) and I’d love to talk if we could help anyone. We also have drop in replacement images and charts for Bitnami, as we describe here: https://www.minimus.io/post/the-bitnami-pricing-changes-what-you-need-to-know https://www.minimus.io/post/the-bitnami-pricing-changes-what... If anyone has tech questions about how it all works, tools we use, customer scenarios, etc I’d be happy to discuss.

CubsFan1060 1y ago
The main question as always is price. I was also interested in things like Chainguard and Docker secure images until I had a sales call with them and found out the price. I can’t seem to find the price anywhere on your site… I assume the reason for that is that it’s also nearly impossible for a non-fortune 500 to afford?
- morellonet 1y ago
  Nope - we're early stage so we're really flexible not just on pricing but licensing terms too. We have many customers that are smaller startups, not just typical F500 types.
mdaniel 1y ago
Please offer an implementation of the docker-credential helper, just like chainguard does with docker-credential-cgr[1], and don't put throwaway text that says "docker supports credential stores, so good luck to you" on your website https://docs.minimus.io/foundations/authentication#using-a-credential-store https://docs.minimus.io/foundations/authentication#using-a-c... 1: https://edu.chainguard.dev/chainguard/chainguard-images/chainguard-registry/authenticating/#authenticating-with-the-chainctl-credential-helper https://edu.chainguard.dev/chainguard/chainguard-images/chai...
- morellonet 1y ago
  It's on the roadmap :) It's a good feature, just hasn't been prioritized so far because customers haven't really had trouble with the current basic approach.
mdaniel 1y ago
Also, this form is nonsensical https://www.minimus.io/get-started#signup-form https://www.minimus.io/get-started#signup-form because it distinguishes between "Individual" and "Organization" but then Company is a mandatory field. Maybe just go ahead and label it "Lead Gen / Ask For A Demo"
- mdaniel 1y ago
  Not that anyone cares, but I can confirm this is the case: the response is an email from some marketing person asking to "have a call" and then a few days later my email gets some random spam from being subscribed to every mailing list they own. What a farce
carrodher 1y ago
Let me rewrite the comparison used in the "Example: Using Bitnami vs. Minimus" section of the blog post: Using Bitnami Secure Images: You pull a versioned PostgreSQL image built on a minimal-attack-surface OS (Photon). When a CVE is disclosed or a new upstream version is released, Bitnami’s automation takes care of everything: a new container image (and Helm chart, if applicable) is built, tested, and published to your registry within hours. All you need to do is update to the latest version; no manual CVE monitoring, triage, or patching required.
Beltran 1y ago
Is Minimus OS? Bitnami continues as OS project and anyone can build the images from source.

CubsFan1060 1y ago

The main question as always is price. I was also interested in things like Chainguard and Docker secure images until I had a sales call with them and found out the price. I can’t seem to find the price anywhere on your site… I assume the reason for that is that it’s also nearly impossible for a non-fortune 500 to afford?

morellonet 1y ago
Nope - we're early stage so we're really flexible not just on pricing but licensing terms too. We have many customers that are smaller startups, not just typical F500 types.

mdaniel 1y ago

Please offer an implementation of the docker-credential helper, just like chainguard does with docker-credential-cgr[1], and don't put throwaway text that says "docker supports credential stores, so good luck to you" on your website https://docs.minimus.io/foundations/authentication#using-a-credential-store https://docs.minimus.io/foundations/authentication#using-a-c... 1: https://edu.chainguard.dev/chainguard/chainguard-images/chainguard-registry/authenticating/#authenticating-with-the-chainctl-credential-helper https://edu.chainguard.dev/chainguard/chainguard-images/chai...

morellonet 1y ago
It's on the roadmap :) It's a good feature, just hasn't been prioritized so far because customers haven't really had trouble with the current basic approach.

mdaniel 1y ago

Also, this form is nonsensical https://www.minimus.io/get-started#signup-form https://www.minimus.io/get-started#signup-form because it distinguishes between "Individual" and "Organization" but then Company is a mandatory field. Maybe just go ahead and label it "Lead Gen / Ask For A Demo"

mdaniel 1y ago
Not that anyone cares, but I can confirm this is the case: the response is an email from some marketing person asking to "have a call" and then a few days later my email gets some random spam from being subscribed to every mailing list they own. What a farce

carrodher 1y ago

Let me rewrite the comparison used in the "Example: Using Bitnami vs. Minimus" section of the blog post: Using Bitnami Secure Images: You pull a versioned PostgreSQL image built on a minimal-attack-surface OS (Photon). When a CVE is disclosed or a new upstream version is released, Bitnami’s automation takes care of everything: a new container image (and Helm chart, if applicable) is built, tested, and published to your registry within hours. All you need to do is update to the latest version; no manual CVE monitoring, triage, or patching required.

Beltran 1y ago

Is Minimus OS? Bitnami continues as OS project and anyone can build the images from source.