Minimus vs Chainguard: wind-down registry or live Wolfi catalog?
Choose Chainguard when you need a live hardened container catalog with paid CVE SLAs. Treat Minimus as a near-zero CVE catalog that is winding down, with reg.mini.dev scheduled off on 22 October 2026 and key assets moving to Echo. Images previously pulled into your environment still work after the registry cutoff; the risk is new pulls and ongoing CVE rebuilds from reg.mini.dev.
Your cluster still runs fat node:20 and debian:bookworm bases. In an illustrative scanner scenario, a fat base can surface 180+ findings on packages the app never imports (not a measured benchmark from our lab). AppSec opens tickets. Platform pins digests. Nothing removes the bloat that keeps regenerating the queue.
Hardened minimal catalogs exist so that weekly work becomes “rebuild on the vendor’s patched base,” not “triage CVEs in a full OS you did not mean to ship.” Between these two, Chainguard is the live commercial Wolfi-based catalog with Free / Catalog Starter, Per Image, and Catalog pricing plus contractual CVE SLAs on paid tiers. Minimus shipped free Community Edition near-zero CVE images built from source on a distroless MinimOS base, then announced it is ending operations: maintenance from 24 August 2026, registry reg.mini.dev off on 22 October 2026, with key technology and assets acquired by Echo (27 August 2026).
Match the requirement you still own: standardize on a vendor catalog that will still rebuild and remediate after October 2026, or finish a Minimus migration with Echo transition terms confirmed.
| Job | Was hardened near-zero CVE container images (Community free gallery + Enterprise SLAs, Image Creator, registry sync). Commercial path ending; registry off 22 Oct 2026 | Hardened minimal container images (Wolfi / Chainguard OS, apko builds) with SBOMs, Sigstore signatures, nightly rebuilds, and paid CVE remediation SLAs; catalog also expands into Libraries and VMs |
|---|---|---|
| How a bad day closes | While live: pull updated Minimus tag, rebuild app image, redeploy. After 22 Oct 2026: no further updated images from reg.mini.dev; plan Echo transition or another catalog | Rebuild on latest Chainguard tag under organization entitlements; paid tiers add contractual remediation windows and Custom Assembly for packages you still need |
| Day-to-day workflow | During maintenance: migrate off Minimus registry, confirm pulled digests, talk to Echo about transition. After wind-down: no Minimus update queue | Image CVE / rebuild queues, catalog entitlement coverage, FIPS/STIG variants where required, Custom Assembly package gaps |
| Deploy | Was OCI pulls from reg.mini.dev (Community no auth wall; Enterprise self-host / registry sync, Actions). Pulls before cutoff keep running but stop receiving updates | Pull from cgr.dev (free/public and org Production); Docker Hub mirrors for some free images; mirror into Artifactory, ECR, Harbor, and peers |
| License/pricing | Community was free across gallery; Enterprise was sales with contractual CVE SLAs. Not a stable long-term purchase path after Oct 2026 wind-down | Free Images / Catalog Starter (up to 5 images); Per Image; Catalog starts at $19K for a team of 10 (quote-required: confirm billing period and whether $19K is annual; full catalog access + CVE SLA; confirm billing period on quote) (chainguard.dev/pricing, checked 30 Sep 2026) |
| Who operates it | Was platform/AppSec owning base-image standardization; survivors now own migration cutover | Platform and security owning golden / approved base images and CVE SLA evidence |
We reviewed minimus.io product and contact wind-down pages, the Community Edition launch post, Echo’s Minimus acquisition post, chainguard.dev product and pricing pages, Chainguard Academy container overview, and live community threads the same day (30 Sep 2026). We did not run either catalog in a paid tenant or rebuild production images, so this is not a hands-on CVE bake-off. Chainguard is an active commercial catalog. Minimus is in a scheduled wind-down through 22 October 2026.
Minimus
Chainguard
Chainguard’s recent first-party product signal is the live Containers / Libraries / VMs portfolio with Catalog Starter and Catalog pricing on chainguard.dev. Minimus’s decisive 2026 signal is the wind-down timeline and the Echo asset path, not a new enterprise SKU.
Editions and pricing
Vendor life decides the invoice more than a feature matrix. One catalog is selling Free, Per Image, and Catalog tiers. The other is finishing a 60-day maintenance window before the registry turns off.
| Status (30 Sep 2026) | Ending operations; maintenance from 24 Aug 2026; registry off 22 Oct 2026; key assets acquired by Echo (announced 27 Aug 2026) | Active commercial vendor; Containers plus Libraries and VMs on first-party pricing |
|---|---|---|
| How you buy it now | No stable new multi-year rollout. Enterprise customers were directed to wind-down / refund discussions. Echo is meeting Minimus customers on transition | Free Images / Catalog Starter self-serve path; Per Image and Catalog via sales / console entitlements |
| Public units | Community: free gallery. Enterprise: contractual CVE remediation and support SLAs (historical first-party: 1 calendar day for CISA KEV after upstream fix; 2 days critical/high; 14 days medium/low) | Catalog Starter: up to 5 images free. Catalog: starts at $19K for a team of 10 (quote-required: confirm billing period / annual; full catalog access + CVE SLA; confirm billing period on quote). Per Image: licensed by count and type (base, app, AI/ML, FIPS) |
| What the invoice covers | Was image gallery + Enterprise controls (Image Creator, Actions, SSO/RBAC, air-gapped sync). Commercial invoice path ends with wind-down | Entitled hardened images under CVE SLA, optional FIPS/STIG, Custom Assembly, console management; separate Libraries and VMs SKUs if you expand beyond containers |
If procurement needs a catalog that will still accept new entitlements in 2027, budget Chainguard. Do not treat Minimus Community or Enterprise pages as a durable purchase path past the October cutoff.
How base-image CVEs close
| Build model | Was continuous builds from upstream source on a distroless MinimOS base; Community and Enterprise shared the same images | Distroless Wolfi / Chainguard OS images built with apko; nightly rebuilds; SBOMs and Sigstore signatures on builds |
|---|---|---|
| Remediation promise | Enterprise published calendar-day SLAs tied to upstream fixes (KEV / severity bands). Community had no contractual SLA | Paid tiers: contractual CVE SLA (first-party lists 7 days critical, 14 days high/med/low on the pricing feature table). Free Images are not under that SLA |
| Scanner story | Marketed near-zero CVE / ~98% fewer vulnerabilities vs fat bases; SBOMs and signatures per build | Markets low-to-zero known CVEs via minimal packages, rapid updates, and security advisories scanners consume |
| Debug / customize | Was -dev richer variants plus Enterprise Image Creator for custom recipes under the same SLAs | -dev variants with shell/tools; Custom Assembly / private APK packages on paid catalog paths |
That paid-catalog outcome is the weekly close Chainguard still sells. Minimus aimed at the same minimal-base outcome with a wider free gallery, but longevity now sits with Chainguard or the Echo transition, not a new Minimus contract.
Catalog breadth and free tiers
| Free access shape | Community Edition (Jun 2026): full gallery, major/minor versions, no signup/auth wall while the registry remains up | Free Images (~50 latest-tagged public images, no CVE SLA) plus Catalog Starter (five selectable free images of your choice, including previous/supported versions; non-FIPS; no contractual CVE SLA) |
|---|---|---|
| Paid catalog shape | Enterprise: same images plus SLAs, Image Creator, Actions, SSO/RBAC, air-gapped sync | Per Image or Catalog (3,000+ images on pricing page; full versions, FIPS/STIG options, Custom Assembly, request new images) |
| Compliance variants | First-party marketed FIPS, CIS, NIST SP 800-190, STIG on Community and Enterprise images | FIPS-validated and STIG-hardened images on paid paths; FedRAMP-oriented customer stories on first-party |
| Beyond containers | Container images and Helm charts as the published center while live | Containers plus Chainguard Libraries (Python, Java, JavaScript) and Chainguard VMs on first-party pricing |
That longevity fear landed harder after Minimus posted its wind-down. Between these two, Chainguard’s free tier is deliberately narrow; Minimus’s free gallery was wide and is now time-boxed by the registry cutoff.
Where they overlap
Both sold one shared buyer pain: stop drowning in CVEs from fat public bases by switching to minimal, continuously rebuilt images with SBOMs and signatures. Both talked drop-in replacements, distroless-style attack-surface cuts, and enterprise SLAs for teams that need contractual remediation. An RFP that only says “zero CVE container images” is a historical comparison, not a live dual bake-off. The remaining split is commercial life and catalog continuity: Chainguard is the live Wolfi catalog you can still entitle; Minimus is a wind-down catalog whose lasting path is migration (including Echo) before 22 October 2026.
Related supply-chain compares live under Compare, including Chainguard vs Socket. Broader SCA context sits on SCA tools.
Migrating from Minimus
This is not a dual-purchase recommendation. Minimus first-party pages schedule reg.mini.dev off on 22 October 2026, while Echo’s acquisition post says existing Minimus customers do not need to take action to continue using Minimus services and that Echo will meet them on transition. Those messages need reconciliation on your quote before you treat either as a universal outcome. Cutover work that still matters either way: base-image compatibility with your Dockerfiles, signature verification in admission controllers, replacement tags for each Minimus image you still pin, and a staged rebuild/redeploy before you lose update continuity. Chainguard is the live hardened catalog path in this pair for new entitlements.
For new deployments, evaluate a currently supported hardened-image catalog. Existing Minimus customers should confirm their Echo transition, support terms, and registry continuity before choosing a migration path. Choose Chainguard when you need a live hardened image catalog with paid remediation SLAs (and room to grow into Libraries or VMs).
FAQs
Is Minimus still a vendor you can buy long term?
Not as a stable multi-year catalog. Minimus announced it is ending operations, with maintenance from 24 August 2026 and the registry turned off on 22 October 2026. Echo acquired key Minimus assets and is meeting customers on transition. Marketing pages may still render; that is not a durable purchase path past the cutoff.
What happened between Minimus and Echo?
Echo announced on 27 August 2026 that it acquired key Minimus technology and assets as Minimus winds down. Echo’s post says existing Minimus customers do not need to take action to continue using Minimus services, while Minimus first-party pages still schedule reg.mini.dev off on 22 October 2026. Reconcile those messages with Echo or Minimus contacts before you plan Q4 rebuilds.
Does Chainguard replace Minimus for hardened bases?
For teams that used Minimus as a near-zero CVE base-image catalog and need a live commercial vendor with versioned tags and CVE SLAs, Chainguard is the active category peer between these two. For teams already in talks with Echo about Minimus continuity, evaluate that path separately; this page only compares Minimus and Chainguard.
What free options does Chainguard still publish?
First-party pricing lists Free Images (~50 latest-tagged public images, no CVE SLA) and Catalog Starter (five selectable free images including previous/supported versions, no contractual CVE SLA). Paid Catalog and Per Image unlock the full catalog, SLAs, and compliance variants.
What public prices should buyers note?
Chainguard Catalog starts at $19K for a team of 10 with full catalog access and CVE SLA on chainguard.dev/pricing (confirm billing period on quote) (checked 30 Sep 2026); Per Image is quote-based by image count and type. Minimus Community was free; Enterprise was sales with published remediation SLAs. Treat Minimus pricing as historical after the wind-down.
