googlecontainertools/distroless

Distroless is a collection of minimal Docker container images from Google that contain only your application and the specific runtime it needs to run, nothing else. A standard Linux-based Docker image comes bundled with a full operating system including a package manager, a shell, and hundreds of programs and libraries that your app never actually uses. All of that extra software is potential dead weight: more storage, more attack surface for security vulnerabilities, and more noise when security scanners try to flag problems. Distroless strips all of that out. The smallest distroless image is around 2 megabytes, compared to roughly 124 megabytes for a standard Debian image. Because there is no shell or package manager inside the container, there is much less that can go wrong or be exploited if someone breaks in. The practical tradeoff is that debugging becomes harder, you cannot shell into the container and poke around. There is a special "debug" variant of each image that adds a minimal shell for troubleshooting purposes. You would use distroless images when deploying production applications in containers where security, image size, and a minimal footprint matter. They work especially well with the Docker multi-stage build pattern: you use a full build environment to compile your app, then copy only the compiled result into a distroless runtime image. Language-specific variants are available for Python, Java, Node.js, and others.