GoogleCloudPlatform/distroless
Distroless
Distroless provides a set of OCI-compliant minimal base images and hardening tools designed to create secure, language-specific execution environments. These images are stripped of non-essential system binaries, shells, and package managers to reduce the container attack surface.
The project utilizes upstream-tracked automated patching to monitor operating system releases and generate updated images when security vulnerabilities are addressed. It ensures supply chain integrity through image provenance verification using ephemeral-key digital signatures.
The system supports the generation of minimal runtime environments for specific programming languages, bundling only the required shared libraries. For observability, it employs a dual-mode layering approach that allows for internal inspection via separate shell-enabled debug images.
Features
- Language Base Images - Provides standardized, OCI-compliant minimal base images with pre-installed language runtimes for secure execution.
- Minimal Runtime Environments - Generates stripped-down runtime environments containing only the application and language dependencies.
- System Binary Stripping - Provides base images stripped of non-essential system binaries to significantly reduce the container attack surface.
- Minimal Base Image Creation - Builds stripped-down images containing only the application and its runtime dependencies to reduce overhead.
- Minimal Base Images - Ships a set of stripped-down container base images containing only runtimes and minimal dependencies.
- Vulnerability Patching - Automatically detects and patches vulnerabilities by tracking upstream OS releases and regenerating images.
- Language-Specific Packaging - Packages minimal shared libraries and runtime components required for specific programming languages to execute.
- Automated Security Patching - Monitors official operating system releases to automatically generate updated images when security vulnerabilities are fixed.
- Container Surface Reduction - Limits security exploit vectors by removing shells, package managers, and unnecessary binaries from images.
- Container Hardening - Reduces the container attack surface by removing unused components like shells and package managers.
- Runtime-Only Compositions - Creates images containing only the application and its minimal dependencies by omitting shells and package managers.
- Debug Image Layering - Employs a dual-mode layering approach that allows for internal inspection via separate shell-enabled debug images.
- Container Debugging Utilities - Provides utilities to launch shell-enabled versions of minimal images for internal state inspection.
- OCI Compliant Image Sets - Provides a set of standardized container images that follow Open Container Initiative specifications.
- Blob Signature Verifications - Validates image integrity using digital signatures, certificate timestamps, and ephemeral public keys.
- Supply Chain Integrity - Ensures container image provenance and component integrity through the use of cryptographic signatures.
- Provenance Verification - Checks digital signatures using ephemeral keys to confirm the origin and integrity of container images.
- Example Projects - Language-focused container images built using the system.
