What happened
The New Stack has published a piece on the distroless security gap, arguing that bottom-up containers are the next step for OCI images. It starts from a familiar frustration: teams try to shrink their container images to reduce attack surface, and run into problems along the way. The full text was only partly available to us, so we are not going to describe the technical detail of the proposal. Read the original before drawing conclusions.
Why it matters
Most small teams have heard the advice to use smaller base images. It is sensible: fewer packages in an image means less to scan, patch and exploit. But the article’s framing suggests that going distroless is not as clean as it sounds, and that the approach has limits.
For a team without a platform team, this shows up in practical ways. Someone picks a minimal base image to quiet a scanner, then finds that debugging is harder, builds get fiddly, or the image still carries things nobody chose on purpose. Security work that looks finished on a dashboard may not reduce real risk very much.
The wider point is that image hygiene is a build-pipeline question, not only a choice of base image. What goes in, who decides, and how you know what is inside all matter.
What to do this week
- List your production images and note the base image each one uses. Many teams find a few old bases shared by most services.
- Check whether you can say, for each image, what packages it contains. If you cannot produce an SBOM or equivalent, that is the first gap to close.
- Pick one low-risk service and try a minimal or distroless variant in a test environment. Note what breaks, especially debugging and health checks.
- Agree how your team will troubleshoot a container with no shell, for example ephemeral debug containers in Kubernetes, before an incident forces the question.
- Read the New Stack article and decide whether the bottom-up idea is worth a small trial. Treat it as something to evaluate, not something to adopt on a headline.
Need a hand?
Container image choices sit where security, build pipelines and day-to-day operations meet, and it is easy to spend weeks on this with little to show. Our Security & Compliance service covers image hygiene, scanning and supply chain basics for teams without a dedicated platform group. The first call is free and it is with an engineer, not a salesperson.
Source: The distroless security gap: Why bottom-up containers are the next evolution in OCI images
Related service: Security & Compliance