distroless

Most people would benefit from the distroless base image: https://github.com/GoogleContainerTools/distroless It's a base image with binaries from Debian deb package, and with necessary stuff like ca-certificates, and absolutely nothing else, while still glibc-based (unlike Alpine base images). Example images I built with the base image - C binary, <10MB https://hub.docker.com/r/yegle/stubby-dns - Python binary, <50MB https://hub.docker.com/r/yegle/fava - Go binary, 5MB https://hub.docker.com/r/yegle/dns-over-https Another trick I use is to use https://github.com/wagoodman/dive to find the deltas between layers and manually remove it in my Dockerfile.

As an alpine alternative, may I suggest Distroless [1]? I had a lot of issues in the past with alpine due to lack of "community" and docs around some problems, as well as musl causing issues with all sorts of nodejs build tools (bower, yarn). [1]: https://github.com/GoogleContainerTools/distroless

Distroless has debug images for this purpose: https://github.com/GoogleContainerTools/distroless/blob/mast...

You would. Except most statically linked binaries may still need ca-certificates, tzdata, and some other files that libraries expect it to be present on the system. Not to mention, you still need runtimes if you are programming in Java, Python or many other languages. https://github.com/GoogleContainerTools/distroless project gives a way to have these runtimes + their lib dependencies while still maintaining a minimal attack surface.

For anyone who want a small image but with glibc, https://github.com/GoogleContainerTools/distroless is a good choice, especially if you are writing in static linked language e.g. Go and Rust.

things like https://github.com/GoogleContainerTools/distroless should help to reduce the attack surface of your containers.

How about the Distroless containers from Google? https://github.com/GoogleContainerTools/distroless/blob/mast....