Distroless Image
Distroless images contain only the application runtime and dependencies—no shell, package manager, or utilities—reducing size and attack surface.
Purpose
Minimize image security risk, following the least-privilege principle.
Mechanism
Google distroless base images ship only the language runtime (Java/Python/Go) and app dependencies. No shell means no exec-ing in. No package manager means no installing extra tools. Smaller footprint, fewer CVEs.
Use cases
- Image security
- Minimization
- Attack surface reduction