A hardened, minimal runtime for every Salus service

Some of the best security work is invisible. This release is one of those. Every service that makes up Salus now runs on a stripped back, hardened base: the operating system inside each container has been reduced to the bare minimum that service needs to run, and nothing more.

Nothing in the container but the service

Our service images no longer carry a shell, a package manager, or the usual pile of system utilities. What is left is the service itself and the handful of libraries it actually calls.

That matters because most intrusion playbooks assume those tools are there. Land in a container, open a shell, install something, fetch a payload, look around. When none of it exists, the playbook stops at the first step. It is a real reduction in what an attacker could do with a foothold, not only in how likely one is.

A much shorter list of vulnerabilities

Every package inside an image is a package someone has to track, triage and patch. Removing everything that was not load bearing cut the number of advisories that apply to our services to a fraction of what it was.

The practical effect is signal. Vulnerability scans now surface a short, mostly relevant list instead of hundreds of findings in components we never invoke, so the genuinely urgent items get attention straight away rather than being buried. It also strengthens the evidence base for our SOC 2 Type II and ISO 27001 audits, both completing in 2026.

Unprivileged by default

Each service now runs as a non-root user as a property of the platform rather than as something configured service by service. Paired with a base that ships no tooling, a compromised process has neither elevated permissions nor the means to make use of them.

Faster to patch, faster to deploy

Smaller images pull faster, and that shows up in ordinary operations: quicker rollouts, quicker rollbacks, quicker scale out when traffic climbs. It also shortens the security cycle that matters most. When a patch does need to go out, there is less to rebuild and less to move, so the gap between a fix existing and a fix running in production is smaller.

What this means for your deployments

This work sits on our side of the line. It covers the services that make up Salus, not the images you build and ship. Your applications, their base images and their build configuration are untouched, and there is nothing for you to rebuild or redeploy.

---

As always, these changes are live now and require no action on your part. We’d love to hear what you think. Your feedback shapes what we build next.