What does "distroless" actually buy you?

papacketdrop1 week ago3 replies

Distroless images have no shell and no package manager. Beyond a smaller CVE list, what do they really give you?

Discussion

prpradeepn1 week ago

A smaller, known software bill of materials. You can actually reason about what is in the image.

papacketdrop6 days ago

And debugging needs a different workflow — ephemeral containers or debug image variants.

ememilyk5 days ago

Watch glibc vs musl. Switching base images changes more than just size.