SCORE Distroless Images

If an application vulnerability is compromised, an attacker using distroless images has no native tools available to expand the breach due to the exclusion of package managers, shells, and system utilities.

By removing utilities like Bash, cURL, and standard GNU tools, distroless images neutralize Living off the Land (LOTL) attacks by restricting the container strictly to executing the predetermined application binary.

STD.DEV engineers multi-stage build pipelines where code is compiled within fully featured master images, and then only the final artifacts are isolated and transferred into the distroless runtime environment.

Distroless images have a minimized state and a fraction of the storage footprint of traditional distributions, which accelerates image pulls across the infrastructure and guarantees faster cold-starts during auto-scaling events.

The strategic advantage of using distroless images for production deployments is the establishment of an absolute zero-trust runtime environment, which enhances security by minimizing the attack surface.

The minimal attack surface, achieved by removing utilities like Bash and cURL, neutralizes Living off the Land (LOTL) attacks and restricts the container to executing only the predetermined application binary.

The business benefit of faster cold-starts, enabled by the minimized state and accelerated image pulls of distroless images, is improved responsiveness during auto-scaling events.

The core philosophy behind using distroless images is to create a highly specialized architecture that contains only the essential components for application execution, thereby minimizing the attack surface and enhancing security.

STD.DEV excludes package managers, shells, and system utilities from their production container images to establish an absolute zero-trust runtime environment and neutralize potential attack vectors like Living off the Land (LOTL) attacks.