Every Minimus image comes in two variants: a production image and a dev image. Both are minimal, secure, and updated daily — but they serve different purposes.
- The production variant is the most minimal build: no shell, no package manager, no development utilities. Just the runtime and its direct dependencies.
- The dev variant includes standard tooling and at least one shell, making it suitable for building, testing, and debugging.
Visit the Risk Reduction tab on any image page to compare vulnerability reports for both builds.
Security requirements differ by context. In production, a smaller attack surface matters more than convenience. In development, speed and tooling matter more. Minimus optimizes for both by shipping every image as a tagged pair, allowing you to optimize each time instead of having to settle for a compromise.
Every Minimus image version ships as a complementary pair:
- Production image — e.g.
nginx:latest
- Dev image — e.g.
nginx:latest-dev
Production images contain only what’s needed to run the application. Less code means fewer vulnerabilities, fewer attack vectors, and a smaller blast radius if something goes wrong. Dev images accept a modest size increase in exchange for a shell, package manager, and common utilities suited to the inner loop of building, testing, and debugging, all while still staying far leaner than the official upstream image.
Why dev images simplify migration to Minimus
A common concern when adopting distroless images is losing the shell and package manager teams rely on for troubleshooting. Since every Minimus image already ships with a dev variant that keeps those tools intact, you don’t have to give up familiar workflows on day one - you can migrate at your own pace and switch the final build stage to the distroless production image once you’re ready.
Build more secure apps using multi-stage builds
The prod/dev pair is designed for multi-stage workflows. Use the dev image for intermediate build steps — compiling, testing, installing dependencies — then switch to the production image for the final stage. The result is a lean, secure artifact with no build tooling included. Learn more
Risk reduction reports for dev images
Every Minimus image has a risk reduction report. The report compares the latest version to the public image in both the production and dev builds. For example, you can see the report for the Python-FIPS latest-dev image.
The report defaults to the production latest version, so you’ll need to toggle the button to switch to the latest-dev report.
For FIPS images, the FIPS-verified Minimus image is usually compared against a non-FIPS public image.
Easily compare dev and production images side by side
The Minimus interface makes it easy to see the security trade-off when comparing production images vs. dev images. The image line shows the builds side by side with a vulnerability count by severity. The dev image often trades a little security for convenience, and sometimes that trade is worth it. The choice is yours.
