Comparison
Base imagevsDistroless image
Base image
a vulnerability was reported in a library you have never imported, because it came in the operating system underneath your code.
The image your build starts from, contributing an operating system userland and whatever else its author put in. It is the largest single decision about your image's size and attack surface, and it is inherited silently — most of the findings in a scan report belong to it rather than to anything you wrote. Choosing a smaller base is usually the cheapest security work available to a team.
Full entry →Distroless image
you shell into the container to debug it and there is no shell, because the image contains your binary and its libraries and nothing else.
A base image with no package manager, no shell and no general-purpose utilities — only the runtime files an application needs. It cuts the vulnerability count dramatically and removes the tooling an attacker would use after a remote code execution. The trade is operational: debugging needs an ephemeral sidecar or a copy of the image with tools added, which teams discover during their first incident on one.
Full entry →