distroless

> If you have one image based on Ubuntu in your stack, you may as well base them all on Ubuntu, because you only need to download (and store!) the common base image once This is only true if your infrastructure is static. If your infrastructure is highly elastic, image size has an impact on your time to scale up. A great example is using spot instances; in my line of work we need to create thousands of spot instances to run many millions of time-sensitive batch jobs at certain times and dates, then scale those instances down rapidly to reduce the bill. Of course, there are better choices than Alpine to optimize image size. Distroless (https://github.com/GoogleContainerTools/distroless) is a good example.

>tons of docker images in production that lack basic debugging functionality like... a shell That's a commendable security practice. A whole class of vulnerabilities is mitigated (and others are much harder to exploit) if you don't add unnecessary junk to your images, like a shell. It's also endorsed by Google via distroless: https://github.com/GoogleContainerTools/distroless

I hadn't heard of "distroless" before. Confusing name for a container with just main process runtimes, but neat idea. https://github.com/GoogleContainerTools/distroless

If you are optimizing for image size, Alpine is not the best choice. For example, Distroless (https://github.com/GoogleContainerTools/distroless) has options 50% smaller than Alpine.

From my side I'd love to see clear comparison to distroless[1] images, the best info I could find was this Github issue comment[2], although I would expect to find it in https://github.com/wolfi-dev#faq. Or maybe my google-fu failed me :( [1]: https://github.com/GoogleContainerTools/distroless [2]: https://github.com/tektoncd/pipeline/issues/5507#issuecommen...

Lots of examples without the entire OS as other comments mention, an example would be Googles distroless[0] [0]: https://github.com/GoogleContainerTools/distroless

I find Docker running a full Linux userspace a little bloated. Thankfully there are distroless base images(https://github.com/GoogleContainerTools/distroless). Haven't done service dev in a while, so I don't really have experience with this, but it looks promising.

I tend to grab /etc/passwd out of the container to see what user they added for this purpose. For my own images, I use distroless (gcr.io/distroless/static-debian11:nonroot), and they use 65532: https://github.com/GoogleContainerTools/distroless/blob/main... (I tend to write go and CGO_ENABLED=0, so I typically just pick any user and it doesn't matter. But it can matter in many common cases, so it's worth checking now to save confusion and trouble later. But, it's /etc/passwd that names the user, and filesystem internals that control file access. Typically if a container is designed for nonroot, the relevant files will be owned by the nonroot user they picked. But not always!)

One of my favourite Go security features is the single binary output, it means I can build my binaries into a distroless base image container for running in K8S. It removes a huge attack and vulnerability surface that containers introduce. My team uses Go whereas the rest of the company heavily uses Python. Our vulnerability scanner tool detects hundreds of high score CVEs just in their container images. Comparably there have been times I haven’t updated our distroless base image for a year and there isn’t even a single vulnerability (this one: https://github.com/GoogleContainerTools/distroless/blob/main...) In terms of defending your software supply chain, eliminating the cruft that is required to run an interpreted language in a container make a a huge difference.

For code that compiles into a binary like Rust, distroless is another option for a minimal image that doesn't run into the compiling issues of Alpine. (Python and Node are supported but lose benefits rapidly depending on any added dependencies) https://github.com/GoogleContainerTools/distroless