Home / Knowledge hub / Distroless image
Knowledge hub
Distroless image
A minimal container image with no shell or package manager for an attacker to use.
What it means
A distroless image is a container image that contains your application and the libraries it needs to run, and leaves out the rest of an operating system. There is no shell, no package manager and few of the everyday tools. The name comes from the Google project that popularised the approach. Language runtimes such as Java, Python or Node can be included, and so can your compiled program.
The idea is simple. What is not in the image cannot be used against you, and cannot be flagged by a scanner. A smaller image also has fewer components to patch. It is a close cousin of a slim base image, taken one step further.
Why it matters
When an attacker finds a way to run commands inside a container, the first thing they want is a shell, then tools to download more. A distroless image takes those away, so a small flaw has a harder path to becoming a large one. Less to work with means more effort, more noise and more chances of being noticed.
It also cuts noise. Scanners report fewer known-vulnerable components when there are fewer components, which saves your team time on findings that never applied to your service. A short, clean report is also easier for customers and auditors to accept.
How it shows up
You meet it in the final stage of a multi-stage build: build with a full image, then copy only the finished program into a minimal one. Common mistakes include copying build tools across anyway, and running as root inside an otherwise tiny image.
The cost is debugging. With no shell, you cannot open a terminal in the container. Teams use debug variants of the images in testing, or Kubernetes debug containers attached to a running pod. Plan for this before an incident, not during one.
Questions people ask
Distroless image, answered
Does a distroless image make my app secure?
No. It reduces what an attacker can do after a foothold. It does nothing about flaws in your own code, such as broken access checks or injection.
Think of it as one layer in a stack of defences.
How do I debug a container with no shell?
Distroless projects publish debug tags that add a small shell for non-production use. In Kubernetes, you can attach a temporary debug container to a running pod.
Logs and metrics reduce how often you need either.
Is distroless the same as Alpine?
No. Alpine is a small Linux distribution that still includes a shell and a package manager. Distroless images drop those too.
Alpine is smaller than most full distributions, and distroless is smaller still.
Do distroless images still need patching?
Yes. The runtime and libraries inside can still have flaws, so rebuild on a schedule and when fixes are published.
There are simply fewer parts to watch. Treat the image like any other dependency, with a rebuild schedule.
Does it work for every language?
Mainly for programs that compile to a binary or that have a published runtime image, such as Go, Java, Python or Node.
Software that expects to call shell commands at run time will break and need changes.
Sources
Where this comes from
Related
Terms that sit next to this one
Base image
The starting image your container builds on, and the old packages it can bring.
Container escape
Breaking out of a container to reach the machine that hosts it.
Rootless container
A container run as an ordinary user, limiting damage if it is broken into.
Container image scanning
Checking a built image for known-vulnerable packages before it ships.
Docker
A tool for packaging an app and its dependencies into a portable container.
Which flaws does a small image miss?
A smaller image shrinks what an intruder can use, and it does not close logic flaws in the app. Cyberlop finds those in the running application and proves each one with a request and response. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.