A distroless image is a “new” type of Docker image developed by Google.
It's almost the smallest image you can find.
It leaves out the shell, the package manager, and most tools you find in a full Linux system.
Why use distroless images
When building Docker images, you want to make them as small as possible for both security and performance reasons.
But most base images include build tools that aren't required to run your app.
They make the image big and add more bugs.
One fix is to start from an empty image: scratch. But it lacks many important things:
It has no user files.
It has no CA certificates for secure links.
It has no time zone data. It has no shared libraries.
Distroless images fix this. They are as close to empty as they can be. But the important files are still there.
How to build with them
Since these images have no shell and build tools, you can't use them alone.
Instead, use them with a multi-stage build.
First, you build your app in a normal image with build tools and shells. Then run your binary in the distroless image.
# Build stage: full toolchain available
FROM golang:1.24 AS build
WORKDIR /src
COPY . .
RUN CGO_ENABLED=0 go build -o /bin/app
# Runtime stage: just the binary
FROM gcr. io/distroless/static-debian13
COPY --from=build /bin/app /app
CMD ["/app"]
Four main types of distroless images
static: This is the smallest one. It is about 2MB. It has no libc and no package manager. Use it for apps that are fully static, like Go programs.
base-nossl: It builds on static and adds the C library glibc.
base: It builds on base-nossl. It adds libssl.
cc: It builds on base. It adds libgcc. Rust and languages that need an interpreter like Node.js or Python usually need this.
Verdict
Distroless images are smaller and safer. But the trade-off is that there's no shell or package managers, which makes adding OS packages and debugging difficult. Overall, they are still a great alternative to using the scratch image in a production build.
- Fee from Anime Coders
PS: After god knows how many months, I finally finished writing 95% of the course. Expect a release soon.
