#FoundersOnFire with John Morello of Minimus

In this episode of Founders on Fire, host Rose Ross sits down with John Morello, CTO and co-founder of Minimus (LinkedIn), winner of the 2025 Containers Trailblazers Award.

Minimus is tackling one of the most persistent problems in modern cloud-native security: organisations can carefully secure their own applications while still inheriting potentially hundreds of vulnerabilities from the container images on which those applications are built.

John and his fellow Minimus founders know this space particularly well. The team previously built container security pioneer Twistlock, which was acquired by Palo Alto Networks in 2019 and subsequently incorporated into Prisma Cloud. Now they are approaching the vulnerability problem from a different direction: instead of finding more vulnerabilities after they have entered the software stack, Minimus is trying to stop unnecessary vulnerable components getting there in the first place.

The vulnerability problem hiding inside container images

One of the central themes of the conversation is that a container can inherit a security problem before a developer has written a single line of application code.

Developers routinely build applications using familiar upstream images containing operating system libraries, utilities, package managers and numerous other software components.

The problem is that many of those components may never actually be required by the application.

Every unnecessary package adds more code, more dependencies and potentially more vulnerabilities. It also gives an attacker more tools to exploit if they manage to compromise the container.

Minimus takes a deliberately minimalist approach. Its hardened images are built from source and remove software that is not required for the workload, reducing the number of packages and therefore shrinking both the vulnerability count and the potential attack surface.

The company says its images are often dramatically smaller than standard alternatives and are continuously rebuilt and scanned as vulnerabilities emerge. Its current catalogue contains thousands of hardened images designed to achieve a zero or near-zero CVE starting point.

Finding vulnerabilities versus preventing them

There is an interesting connection between what John and his colleagues achieved with Twistlock and what they are now building at Minimus.

Twistlock helped organisations identify and manage vulnerabilities across containerised environments. But detecting vulnerabilities inevitably leaves somebody with another problem: fixing them.

Minimus moves that intervention further upstream.

Instead of handing a development or security team a long list of vulnerabilities and asking them to remediate each one, the objective is to build a cleaner software foundation from the outset.

That means taking popular open-source applications and runtimes, rebuilding them directly from source and including only the components required for them to work.

The result is not simply fewer vulnerability alerts. Removing shells, package managers, compilers and other unnecessary software can also deprive an attacker of useful tools they might otherwise exploit after gaining access to a container.

For organisations dealing with huge numbers of container workloads, that changes vulnerability management from an endless process of finding and fixing security debt into an opportunity to avoid creating much of that debt in the first place.

Opening hardened containers to everyone

The conversation also explores the thinking behind the Minimus Community Edition.

Rather than putting its hardened image catalogue behind a registration form or sales process, Minimus has opened thousands of images for developers to pull and use free of charge.

There is no login requirement for the Community Edition, allowing developers to experiment with hardened alternatives to many of the images they already use. Minimus also provides image variants designed to support security and compliance requirements including FIPS, CIS, NIST and STIG, with FIPS 140-3 options available for organisations working towards requirements such as FedRAMP.

That accessibility matters because container security ultimately depends on developer adoption.

A security technology may dramatically reduce risk, but if adopting it requires developers to rebuild applications or radically alter existing workflows, friction quickly becomes an obstacle.

Minimus is therefore aiming to make many of its hardened images usable as drop-in replacements for familiar public images.

In some cases, changing the foundation of an application can begin with something as simple as changing the FROM line in a Dockerfile.

Getting AI agents to handle the migration

Artificial intelligence introduces another interesting element to the Minimus approach.

Developers increasingly use coding agents to build, maintain and modify applications. Minimus is turning those same agents into a mechanism for improving container security.

The company has developed agent-ready configuration tools, prompts and instructions that enable AI developer agents to analyse existing Dockerfiles, identify the appropriate Minimus alternatives and make many of the changes required to migrate applications automatically.

As John explains during the conversation, the aim is to remove another source of friction.

Rather than presenting a developer with documentation explaining how to migrate hundreds of containers, an organisation can increasingly allow an AI agent to understand those instructions and perform much of the repetitive migration work itself.

Minimus currently provides agent integration tools for environments including Claude, Codex and Cursor, with its platform designed so agents can help identify, migrate and deploy hardened images.

It is an interesting example of AI being used not merely to detect security problems, but to implement security improvements at scale.

Protecting what comes into the software supply chain

Removing vulnerable components from a base image addresses one part of the problem.

But modern applications continually pull software from elsewhere.

Developers rely heavily on public package repositories such as npm for JavaScript and pip for Python. Those ecosystems enable enormous development speed, but they can also become attack vectors.

A malicious package might deliberately imitate the name of a legitimate dependency through typosquatting. A newly compromised or suspicious package could potentially enter a build pipeline before security teams realise anything has changed.

Minimus has therefore extended its approach beyond the container image itself.

Its supply-chain protection can place policies around package installations, allowing organisations to block or flag packages according to factors including how recently they were released, their download reputation and potential typosquatting risk. Support currently includes Node/npm and Python environments.

The principle is that trusting an application means understanding not only the code your organisation writes, but the entire chain of third-party software entering the finished product.

Making compliance part of the image

The discussion also highlights another challenge familiar to security and DevOps teams: proving that software is secure can create almost as much work as securing it.

Enterprise and public-sector organisations increasingly need Software Bills of Materials, provenance information, vulnerability reports and evidence that software aligns with recognised security standards.

Minimus builds much of this information into the container lifecycle itself.

Its images include signed Software Bills of Materials, while compliance-oriented options and reporting support standards and frameworks including CIS Docker Benchmark, NIST SP 800-190, FIPS 140-3 and FedRAMP-related requirements.

This turns compliance evidence from something assembled retrospectively into something that can travel alongside the software.

For security teams, developers and auditors, that could significantly reduce the amount of manual work involved in demonstrating exactly what is inside a container and where it came from.

Removing vulnerabilities rather than managing more of them

Throughout the conversation, John makes the case for changing how organisations think about vulnerability management.

Security tools have become exceptionally good at finding problems.

But generating another dashboard containing thousands of CVEs does not necessarily make an organisation safer if development and security teams do not have the time to remediate them.

Minimus is built around a much simpler idea: if a piece of software does not need to be inside an application, why put it there at all?

Smaller images mean fewer components to monitor, fewer potential vulnerabilities to patch and fewer tools available to an attacker.

Combine that with automated rebuilding, software supply-chain controls and AI-assisted migration, and container security starts moving away from reactive vulnerability management towards security by design.

Tune in to hear why John Morello believes organisations need to rethink the software foundations their applications are built on, how Minimus is using minimal container images to pursue a zero-CVE starting point, and why AI agents could make moving entire application estates onto more secure foundations dramatically easier.

Could you be our next Containers Trailblazer?

Minimus was named the winner of the 2025 Containers Trailblazers Award, recognising its innovative approach to reducing vulnerabilities and attack surface within enterprise container environments.

The company’s success did not stop there. Minimus was also named a runner-up in the 2025 Networking Trailblazers Award.

The Tech Trailblazers Awards celebrate ambitious enterprise technology startups and scale-ups developing innovative technologies, challenging established approaches and solving important business problems.

For the 2026 Awards, eligible enterprise technology startups and scale-ups must be under ten years old, based on the date the company was founded, and privately funded or at Series C funding or below.

Entries for the 2026 programme close on 17 September 2026 at 23:59 Pacific Time.

Find out more about the Containers Trailblazers Award and start your 2026 entry.

Stay in touch with Tech Trailblazers

Email us at innovate@techtrailblazers.com

Sign up for Tech Trailblazers updates

Follow Tech Trailblazers on LinkedIn