GoogleCloudPlatform/distroless
Distroless
Distroless provides a set of OCI-compliant minimal base images and hardening tools designed to create secure, language-specific execution environments. These images are stripped of non-essential system binaries, shells, and package managers to reduce the container attack surface.
The project utilizes upstream-tracked automated patching to monitor operating system releases and generate updated images when security vulnerabilities are addressed. It ensures supply chain integrity through image provenance verification using ephemeral-key digital signatures.
The system supports the generation of minimal runtime environments for specific programming languages, bundling only the required shared libraries. For observability, it employs a dual-mode layering approach that allows for internal inspection via separate shell-enabled debug images.
Features
- Language Base Images - Provides standardized, OCI-compliant minimal base images with pre-installed language runtimes for secure execution.
- Minimal Runtime Environments - Generates stripped-down runtime environments containing only the application and language dependencies.
- System Binary Stripping - Provides base images stripped of non-essential system binaries to significantly reduce the container attack surface.
- Minimal Base Image Creation - Builds stripped-down images containing only the application and its runtime dependencies to reduce overhead.
- Minimal Base Images - Ships a set of stripped-down container base images containing only runtimes and minimal dependencies.
- Vulnerability Patching - Automatically detects and patches vulnerabilities by tracking upstream OS releases and regenerating images.
- Language-Specific Packaging - Packages minimal shared libraries and runtime components required for specific programming languages to execute.
- Automated Security Patching - Monitors official operating system releases to automatically generate updated images when security vulnerabilities are fixed.
- Container Surface Reduction - Limits security exploit vectors by removing shells, package managers, and unnecessary binaries from images.
- Container Hardening - Reduces the container attack surface by removing unused components like shells and package managers.
- Runtime-Only Compositions - Creates images containing only the application and its minimal dependencies by omitting shells and package managers.
- Debug Image Layering - Employs a dual-mode layering approach that allows for internal inspection via separate shell-enabled debug images.
- Container Debugging Utilities - Provides utilities to launch shell-enabled versions of minimal images for internal state inspection.
- OCI Compliant Image Sets - Provides a set of standardized container images that follow Open Container Initiative specifications.
- Blob Signature Verifications - Validates image integrity using digital signatures, certificate timestamps, and ephemeral public keys.
- Supply Chain Integrity - Ensures container image provenance and component integrity through the use of cryptographic signatures.
- Provenance Verification - Checks digital signatures using ephemeral keys to confirm the origin and integrity of container images.
- Example Projects - Language-focused container images built using the system.
Star history
How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.
