GoogleContainerTools/distroless
Distroless
Distroless provides a collection of security-hardened, minimal base container images designed to reduce attack surfaces by excluding non-essential system utilities, package managers, and shells. These images are constructed to contain only an application and its specific runtime dependencies, enforcing the principle of least privilege by configuring environments for non-root execution.
The project distinguishes itself through a focus on supply chain integrity and reproducible builds. It utilizes declarative build configurations to track package versions and validates container image integrity through cryptographic signatures. By bundling language-specific runtimes—including Java, Python, and JavaScript—alongside statically linked dependencies, it ensures that production environments remain consistent and free of unnecessary binaries.
The platform supports diverse infrastructure requirements by generating multi-architecture image manifests from single source definitions. While the default images are stripped-down for security, the project also provides optional debug-enabled variants that include essential troubleshooting tools. Comprehensive package metadata is exposed to facilitate auditing and verification of all software components within the container environment.
Features
- Container Base Images - Offers minimal, language-specific container base images containing only essential runtime dependencies.
- Container Image Packaging - Bundles applications into stripped-down container images containing only essential dependencies to minimize attack surfaces.
- Container Image Optimizers - Ships stripped-down container images containing only essential application dependencies to minimize attack surfaces.
- Hardened Container Images - Provides standardized, security-hardened base container images designed to reduce attack surfaces.
- Minimalist Runtimes - Executes applications in stripped-down container environments that exclude shells and package managers.
- Supply Chain Integrity - Validates container image integrity through cryptographic signatures and detailed package metadata.
- Provenance Verification - Validates container image integrity through cryptographic signatures to ensure supply chain security.
- Secure Execution Environments - Deploys production applications within hardened, non-root execution environments that exclude unnecessary system tools.
- Container Hardening - Enforces non-root execution and minimal system access to reduce the attack surface of containerized applications.
- Build Configurations - Uses structured build files to define exact package versions and contents for reproducible container images.
- Rootfs Construction - Builds container images by assembling only essential runtime dependencies while omitting shells and package managers.
- Image Integrity Verification - Validates digital signatures of container images to ensure only trusted code is deployed.
- Container Runtimes - Provides language-specific runtime environments packaged into minimal, secure container images.
- Least Privilege Enforcement - Configures container images to run applications with restricted user privileges to enforce least privilege.
- Base Images - Language-focused images without an underlying OS.
- Container Images - Triggers automated container image builds to ensure registries contain the latest runtime versions.
- Multi-Architecture Images - Generates cross-platform container images from single source definitions to support diverse hardware architectures.
- Multi-Architecture Deployments - Builds container images for diverse hardware platforms to ensure compatibility across different infrastructure targets.
- Multi-Language Runtimes - Packages Java, Python, and JavaScript applications into optimized, minimal runtime images.
- JavaScript Runtimes - Executes JavaScript applications within minimal container environments containing only necessary runtime dependencies.
- Java Virtual Machine Runtimes - Bundles Java applications into minimal container images containing only necessary runtime dependencies.
- Static Dependency Bundlers - Bundles required system libraries and runtimes into self-contained environments to ensure execution without external tools.
- Compiled Binaries - Bundles minimal Linux runtime environments to execute statically compiled binaries without unnecessary system tools.
- Base Image Distributions - Maintains standardized base images derived from specific operating system releases.
- Library Lookup Caches - Pre-generates library search paths to allow applications to locate dependencies within restricted file systems.
- Version Tracking Tools - Maintains lists of specific package versions from supported distributions to ensure reproducible container builds.
- Package Metadata - Exposes comprehensive package metadata and checksums to facilitate auditing of software components.
