distroless

They could, but "distroless" is already an estabilished name, I think pioneered by Google[1]. As someone close to this field, I immediately know what "distroless" means in this context, and it's unclear what "minimalist" mean (does it mean it's based on Ubuntu Minimal? Alpine? Distroless?). [1]https://github.com/GoogleContainerTools/distroless

I haven't seen ubuntu's version of distroless but the general term implies a container image with an empty shell of what a linux distro provides. Leaving behind only the minimum files for running your app rather than all the cruft around running and maintaining a distro, which is normally all done at container build time. From the Debian based https://github.com/GoogleContainerTools/distroless/blob/main... Statically compiled applications (Go) that do not require libc can use the gcr.io/distroless/static image, which contains: - ca-certificates - A /etc/passwd entry for a root user - A /tmp directory - tzdata Applications that require libc but do not need libssl can use the gcr.io/distroless/base-nossl, which contains all of the packages in gcr.io/distroless/static, and - glibc Most other applications (and Go apps th

Docker images fill a different role. They shouldn't have everything installed on them as that broadens the attack footprint. They should be doing one thing, and one thing only. If it's a "run this executable that was built" - then only what is needed should be there. Installing python and other general purpose tools gives any attacker that gets into a docker container many more tools to work with for getting out. For docker, the trend isn't "build a general purpose machine" but rather "what can we slim this down to that only has the bare minimum in it?" This can be taken all the way to the distroless images ( https://github.com/GoogleContainerTools/distroless ) and means that the security team won't be asking you to fix that CVE that's in Python that you don't use. If, however, you do need python in an image because that image's purpos

lots of questions here regarding what this product is. I guess i can provide some information for the context, from a perspective of an outside contributor. Chainguard Images is a set of hardened container images. They were built by the original team that brought you Google's Distroless (https://github.com/GoogleContainerTools/distroless) However, there were few problems with Distroless: 1. distroless were based on Debian - which in turn, limited to Debian's release cadence for fixing CVE. 2. distroless is using bazelbuild, which is not exactly easy to contrib, customize, etc... 3. distroless images are hard to extend. Chainguard built a new "undistro" OS for container workload, named Wolfi, using their OSS projects like melange (for packaging pkgs) and apko (for building images). The idea is (from my understanding) is that 1. You don't h