distroless README

The project's README from github.com/GoogleContainerTools/distroless. As one markdown file: README.md.

"Distroless" Container Images.

CI Build Status

"Distroless" images contain only your application and its runtime dependencies. They do not contain package managers, shells or any other programs you would expect to find in a standard Linux distribution.

For more information, see this talk (video).

Why should I use distroless images?

Restricting what's in your runtime container to precisely what's necessary for your app is a best practice employed by Google and other tech giants that have used containers in production for many years. It improves the signal to noise of scanners (e.g. CVE) and reduces the burden of establishing provenance to just what you need.

Distroless images are very small. The smallest distroless image, gcr.io/distroless/static-debian13, is around 2 MiB. That's about 50% of the size of alpine (~5 MiB), and less than 2% of the size of debian (124 MiB).

How do I use distroless images?

These images are built using bazel, but they can also be used through other Docker image build tooling.

What images are available?

The following images are currently published and updated by the distroless project (see SUPPORT_POLICY.md for support timelines)

These images refer to image indexes with references to all supported architectures. Architecture specific images can be directly referenced using an additional architecture suffix on the tag, like gcr.io/distroless/static-debian13:latest-amd64

Any other tags are considered deprecated and are no longer updated

Debian 13

Debian 13 distroless images use the debian UsrMerge scheme. If you use rules_distroless to add packages to an image, set mergedusr = True in apt.install.

Image Tags Architecture Suffixes
gcr.io/distroless/static-debian13 latest, nonroot, debug, debug-nonroot amd64, arm64, arm, s390x, ppc64le, riscv64
gcr.io/distroless/base-debian13 latest, nonroot, debug, debug-nonroot amd64, arm64, arm, s390x, ppc64le, riscv64
gcr.io/distroless/base-nossl-debian13 latest, nonroot, debug, debug-nonroot amd64, arm64, arm, s390x, ppc64le, riscv64
gcr.io/distroless/cc-debian13 latest, nonroot, debug, debug-nonroot amd64, arm64, arm, s390x, ppc64le, riscv64
gcr.io/distroless/java-base-debian13 latest, nonroot, debug, debug-nonroot amd64, arm64, s390x, ppc64le, riscv64
gcr.io/distroless/java17-debian13 latest, nonroot, debug, debug-nonroot amd64, arm64, s390x, ppc64le, riscv64
gcr.io/distroless/java21-debian13 latest, nonroot, debug, debug-nonroot amd64, arm64, s390x, ppc64le, riscv64
gcr.io/distroless/java25-debian13 latest, nonroot, debug, debug-nonroot amd64, arm64, s390x, ppc64le, riscv64
gcr.io/distroless/nodejs22-debian13 latest, nonroot, debug, debug-nonroot amd64, arm64, arm, s390x, ppc64le
gcr.io/distroless/nodejs24-debian13 latest, nonroot, debug, debug-nonroot amd64, arm64, s390x, ppc64le
gcr.io/distroless/nodejs26-debian13 latest, nonroot, debug, debug-nonroot amd64, arm64, s390x, ppc64le
gcr.io/distroless/python3-debian13 latest, nonroot, debug, debug-nonroot amd64, arm64, riscv64

Why is distroless still using gcr.io instead of pkg.dev?

Distroless's serving infrastructure has moved to artifact registry but we still use the gcr.io domain. Users will get the benefits of the newer infrastructure without changing their builds.

How do I verify distroless images?

All distroless images are signed by cosign with ephemeral keys (keyless). We recommend verifying any distroless image you use before building your image. You can verify the keyless signature of any distroless image with:

cosign verify $IMAGE_NAME --certificate-oidc-issuer https://accounts.google.com --certificate-identity [email protected]

Entrypoints

Note that distroless images by default do not contain a shell. That means the Dockerfile ENTRYPOINT command, when defined, must be specified in vector form, to avoid the container runtime prefixing with a shell.

This works:

ENTRYPOINT ["myapp"]

But this does not work:

ENTRYPOINT "myapp"

For the same reasons, if the entrypoint is set to the empty vector, the CMD command should be specified in vector form (see examples below). Note that by default static, base and cc images have the empty vector entrypoint. Images with an included language runtime have a language specific default (see: java, nodejs, python3).

Docker

Docker multi-stage builds make using distroless images easy. Follow these steps to get started:

Examples with Docker

Here's a quick example for go:

# Start by building the application.
FROM golang:1.18 as build

WORKDIR /go/src/app
COPY . .

RUN go mod download
RUN CGO_ENABLED=0 go build -o /go/bin/app

# Now copy it into our base image.
FROM gcr.io/distroless/static-debian13
COPY --from=build /go/bin/app /
CMD ["/app"]

You can find other examples here:

To run any example, go to the directory for the language and run:

docker build -t myapp .
docker run -t myapp

To run the Node.js Express example app and expose the container's ports:

npm install # Install express and its transitive dependencies
docker build -t myexpressapp . # Normal build command
docker run -p 3000:3000 -t myexpressapp

This should expose the Express application to your localhost:3000

Bazel

For full documentation on how to use bazel to generate Container images, see the bazel-contrib/rules_oci repository.

For documentation and example on how to create custom container images, see the GoogleContainerTools/rules_distroless repository.

Examples can be found in the GoogleContainerTools/rules_distroless repository.

Examples with Bazel

We have some examples on how to run some common application stacks in the /examples directory. See here for:

See here for examples on how to complete some common tasks in your image:

See here for more information on how these images are built and released.

Base Operating System

Distroless images are based on Debian 13 (trixie). Images are explicitly tagged with Debian version suffixes (e.g. -debian13). Specifying an image without the distribution will currently select -debian13 images, but that will change in the future to a newer version of Debian. It can be useful to reference the distribution explicitly, to prevent breaking builds when the next Debian version is released.

Operating System Updates for Security Fixes and CVEs

Distroless tracks the upstream Debian releases, using Github actions to automatically generate a pull request when there are updates.

Debug Images

Distroless images are minimal and lack shell access. The :debug image set for each language provides a busybox shell to enter.

For example:

cd examples/python3/

edit the Dockerfile to change the final image to :debug:

FROM gcr.io/distroless/python3-debian13:debug
COPY . /app
WORKDIR /app
CMD ["hello.py", "/etc"]

then build and launch with a shell entrypoint:

docker build -t my_debug_image .

$ docker run --entrypoint=sh -ti my_debug_image

/app # ls
BUILD       Dockerfile  hello.py

Note: If the image you are using already has a tag, for example gcr.io/distroless/java17-debian13:nonroot, use the tag debug-<existing tag> instead, for example gcr.io/distroless/java17-debian13:debug-nonroot.

Note: ldd is not installed in the base image as it's a shell script, you can copy it in or download it.

Who uses Distroless?

If your project uses Distroless, send a PR to add your project here!

Community Discussion

distroless (GoogleContainerTools/distroless)

Searching Database…

23.1K ·GitHub
Distroless
What is this?A set of minimal container base images that contain only your application and its runtime dependencies — no package managers, shells or other programs you would expect in a normal Linux distribution.
So these aren't something I install — what am I actually pulling?Prebuilt base images published on gcr.io (e.g. gcr.io/distroless/static-debian13) that you use as the final stage of your build. The project builds them with Bazel, but regular Docker tooling works too.
How do I get my app running on one?Write a Docker multi-stage build (needs Docker 17.05+): one stage builds your app, the final stage copies the artifacts into a distroless image. Bazel users can use rules_oci and rules_distroless, and the repo has runnable examples for Go, Java, Python, Node.js and Rust.
Which language runtimes do these images cover?Debian 13-based images for static binaries, C/C++ (cc), Java 17/21/25, Node.js 22/24/26 and Python 3, plus a bare base image and a base-nossl variant. Each is published as latest, nonroot, debug and debug-nonroot.
If there's no shell inside, what changes in my Dockerfile?ENTRYPOINT must be written in vector (exec) form, e.g. ENTRYPOINT ['/app/server'], otherwise the runtime tries to prefix it with a shell that doesn't exist. Static, base and cc images have an empty entrypoint by default; language images get a language-specific one.
Is this a big-shop-only pattern, or can a small team use it too?Anyone can adopt it — restricting a runtime container to exactly what the app needs is the best practice Google and other tech giants follow, and projects like Kubernetes, Knative, Tekton and Teleport build on these images.
Which CPU architectures are supported?Multi-arch image indexes cover amd64, arm64, arm, s390x, ppc64le and riscv64, though individual runtimes ship slightly different lists. Pin one with a tag suffix like :latest-amd64.
Why pick distroless over Alpine or a slim Debian image?Size and scanner noise: the smallest static image is around 2 MiB — roughly half of Alpine (~5 MiB) and under 2% of Debian (124 MiB). With no shell or package manager inside, CVE scanners report less noise and provenance is easier to establish.
How do I debug a container that has no shell?Switch the image tag to its :debug variant (or debug-nonroot) — those add a busybox shell you can enter. One gotcha: ldd is not included in the base image because it's a shell script.
Why do the images still live under gcr.io?The serving infrastructure has moved to Artifact Registry, but distroless keeps the gcr.io domain so existing builds get the newer infrastructure without any changes.
How are the images kept trustworthy and up to date?Every image is signed by cosign with ephemeral (keyless) keys, and the project recommends verifying before you build on one. Security fixes track upstream Debian releases, with GitHub Actions automatically opening update PRs.
What are similar projects?slim, kaniko, portainer, awesome-docker, docker-minecraft-server, containerd, harbor, distribution
Which topics is it in?container-security, bazel, containerization, docker-image, minimal, supply-chain-security, multi-platform, debian, devops-tools, dockerfile, arm64, lightweight
Creator
GoogleContainerTools
Size
9.9 MB
Stars
23.1K
Updated
CommitOct 15
Age
9y
Commits · 90 Days