Minimus’s Shutdown Turns Hardened Container Images Into a Commodity Problem

Minimus, a container security startup founded by the team that sold Twistlock to Palo Alto Networks for roughly $410 million in 2019, is shutting down. The company says it could not find enough commercial momentum to keep going, and on August 24, 2026, it began a 60-day wind-down: bug fixes and upstream image updates continue through October 22, when its registry goes dark for good. CEO Ben Bernstein put it plainly to Globes: “After a strategic process that did not work out, we decided to close Minimus in an orderly fashion.”

For anyone running Minimus images in production, that deadline is now a migration deadline. Images already pulled will keep working after October 22, but they will stop receiving updates, and any vulnerability discovered in them after that point simply goes unpatched. Docker, a direct competitor in the same hardened image market, is offering free migration help to Minimus customers, and it is not the only one; container security vendor RapidFort has also published its own migration offer for stranded Minimus users.

A Team That Had Done This Before

Minimus was not a first-time founder story. Ben Bernstein, Dima Stopel, and John Morello built Twistlock into one of the first serious container security companies before Palo Alto Networks bought it in 2019. When they came back with a new company in late 2022, first under the name Gutsy before rebranding as Minimus and settling on hardened container images as the focus, investors lined up. The $51 million seed round, led by YL Ventures with Mayfield participating, was one of the largest seed financings in Israeli cybersecurity history, according to CTech. The angel list read like a who’s who of the industry the founders had already succeeded in: Wiz co-founders Assaf Rappaport, Ami Luttwak, and Roy Reznik; former CyberArk CEO Udi Mokady; Transmit Security founders Mickey Boodaei and Rakesh Loonkar; and CrowdStrike CEO George Kurtz, per Globes.

The product itself worked as advertised. Minimus built stripped-down container images and virtual machines from source, rebuilt continuously against upstream code, and claimed to eliminate more than 95 percent of the vulnerabilities found in conventional container images. The company publicly launched on April 28, 2025, and kept shipping: secure Helm charts, compliance dashboards, VEX support, single sign-on. By the time it closed, the company had 35 employees; it had already cut more than 10 people roughly eighteen months earlier, during an internal pivot Globes did not detail further. Minimus is returning roughly $10 million of the original $51 million to investors.

The Free Catalog That Broke the Business Model

The decisive moment came in June 2026, when Minimus made its entire hardened image catalog free, with no registration required. The move was meant to drive adoption. Instead, it removed the reason anyone would pay for it. “Free, unrestricted access to a full hardened-image catalog turns secure base images into a commodity,” analyst Mitch Ashley told Security Boulevard.

Minimus tried to rebuild a paid tier around what was left: support contracts, compliance dashboards, SSO, hardened Helm charts. None of it replaced what giving away the core product had cost. Security Boulevard’s Alan Shimel called this the “Indispensability Trap”: Minimus supplied safer building blocks, but with no control plane to govern which images an enterprise actually chose, verified, or deployed, it had no way to keep customers coming back once the blocks themselves were free. “Support surrounds a commodity,” Shimel wrote. “It does not necessarily reclaim the value lost when the underlying product becomes free.”

There is a demand-side problem underneath the pricing problem, too. An IDC survey of 511 organizations that Shimel cites found only 8.8 percent ranked hardened container images among their top three software supply chain security spending priorities. Enterprises apparently tolerate a fair amount of container CVE debt when the cost of fixing it exceeds the risk of leaving it alone, which makes for a difficult market to build a standalone company on, no matter how good the technology is.

Docker Was Already Giving It Away

The company best positioned to absorb Minimus’s customers was already doing what broke Minimus’s business: giving hardened images away for free. Docker Hardened Images now cover more than 4,000 images, compatible with existing Alpine- and Debian-based Dockerfiles and CI pipelines, with near-zero CVEs, full, unsuppressed CVE visibility, an SBOM, SLSA Build Level 3 provenance, and cryptographic signatures on every image. Docker says teams moving off standard public images see up to 95 percent fewer CVEs and up to 90 percent less attack surface. The base catalog is free under Apache 2.0, with no user caps and full production use allowed; Docker charges for SLA-backed remediation, FIPS and STIG variants, custom builds, and up to five years of support past a component’s end of life.

Docker did not need Minimus’s shutdown to have that offer already built. It just gave Docker somewhere obvious to point Minimus’s orphaned customers, and Docker owns something Minimus never had: the distribution channel millions of developers already use every day to pull images. Docker has spent the past several months pushing Hardened Images and a zero CVE default across its whole platform, and Minimus’s exit removes one of the few competitors making a similar pitch as a standalone product. Chainguard, valued at $5.4 billion on roughly $900 million in funding according to Security Boulevard, is pursuing a different strategy: free images paired with a broader paid platform for verified, trusted source software across libraries, virtual machines, and CI/CD. Iron Bank, the Department of Defense’s own hardened-image registry, which Red Hat and other vendors contribute hardened builds to, occupies a narrower, compliance-driven corner of the same market. None of them are selling bare hardened images as the whole product anymore.

What Minimus Customers Need to Do Before October 22

For teams currently running Minimus images in production, the practical checklist is short but time-boxed. Images already pulled keep running past October 22, but they stop receiving upstream updates the moment the registry goes dark, so any CVE discovered in a Minimus base image after that date has no vendor fix coming. Docker’s pitch is that switching is mostly a drop-in change: for most services, the whole thing is updating the FROM line in a Dockerfile. Docker has published a migration guide, a checklist to track each image through the swap and verification, and worked end-to-end examples, with its Gordon AI assistant running the first pass. Enterprise customers with extended Minimus contracts are being contacted individually about refunds. Anyone who wants to talk to a person first can email [email protected].

The Real Lesson Is About Where the Value Sits

Minimus had good technology, credible founders, and more money than most seed-stage security startups ever see, and none of it was enough once the core product became a commodity. The lesson for the rest of the software supply chain security market is not that hardened images do not matter. It is that a hardened image by itself is now a feature, something a platform bundles in to keep developers inside its ecosystem, not a product a standalone vendor can charge for on its own. The money is moving up a layer, to whoever controls which images an enterprise trusts, verifies, and is allowed to run, and that is a harder, slower business to build than shipping a better base image.