What are Distroless containers ?
Distroless containers
Distroless is evolving the best practices of any system that you use, the firm principal of installing only things you need that should be used on containers and bare metal. It has security and performance advantages due to the smaller footprint of the containers.
Trivy
Trivy is an extensible and versatile security scanner. Trivy has scanners that look for security flaws and targets where those flaws can be found. ( an image having millions of downloads doesn’t mean it’s not prune to vulnerabilities)
trivy image <container>Targets (what Trivy can scan):
- Container Image.
- Filesystem.
- Git Repository (remote).
- Virtual Machine Image.
- Kubernetes.
Scanners (what Trivy can find there):
- OS packages and software dependencies in use (SBOM).
- Known vulnerabilities (CVEs).
- IaC issues and misconfigurations.
- Sensitive information and secrets.
Base images for interpreted or VM-based languages
Some languages (such as Python) require an interpreter in order for a script to run. Others, such as JavaScript or Java, require a full-fledged runtime (like Node.js or JVM). Because the distroless images lack package managers, adding Python, OpenJDK, or Node.js to them may be difficult if you start with a base distroless image. luckily the project maintainers have dedicated for them.
| Image | features | | ------------------ | -------------------------------------------------------------------------- | | distroless/static | ca-certificates, /etc/passwd entry for a root user, /tmp directory, tzdata | | distroless/base | [distroless/static]+glibc, libssl, openssl | | distroless/cc | [distroless/static]+rust | | distroless/node.js | [distroless/static]+node.js modules | | distroless/python | [distroless/static]+python | | distroless/java | [distroless/static]+java |
{{
Conclusion: A container does not have to contain a complete Linux distribution. However, while theoretically viable, pure scratch containers frequently miss critical elements that we instinctively anticipate to be there at all times (like CA certs or timezones). Google is leading one of the distroless projects attempting to make scratch images widely useful.
