Container images your team pulls from  public registries often carry hundreds of known vulnerabilities. These aren't theoretical risks. They're CVEs with published exploits, CVSS scores, and entries in the CISA Known Exploited Vulnerabilities catalog.

The standard response is to scan, triage, and remediate. Your security team runs Trivy or Snyk or Wiz against every image. They get back a list of 500, 800, sometimes 1,200+ CVEs. Then the real work begins: figuring out which ones matter, which ones are false positives, which ones have patches, and which ones are from packages the application doesn't even use.

The cruel irony: most container CVEs exist in packages that were never needed in the first place. They're artifacts of how public images are built. A convenience for the image maintainer becomes a liability for everyone who pulls that image.

This is the vulnerability treadmill. New CVEs are published faster than teams can patch. Scanners surface more findings than developers can process. Security debt accumulates. Releases slow down. Auditors ask questions nobody has time to answer.

The answer isn't better scanning. The answer is fewer vulnerabilities to begin with. If the packages don't exist in the image, the CVEs don't exist in the scan. You can't be vulnerable in a library you don't ship.

This is what Minimus does. We rebuild every container image ourselves directly from upstream source, including only the minimal packages needed to run the application. The result: 97% fewer CVEs on average. Not because we suppress findings. Because the vulnerable code isn't there.