featured · github
Distroless: Strip the OS, Keep the App
Google's container images remove the operating system bloat. What you get: 90% smaller images, fewer vulnerabilities, faster deploys. What you lose: almost nothing that matters.
GoogleContainerTools/distroless ↗Docker images normally bundle an entire operating system (Ubuntu, Alpine, etc.) inside them—even though your app only needs a handful of libraries to run. Distroless images strip away everything except what your code actually uses: the runtime, dependencies, and your binary.
Result: your container shrinks from 500MB to 50MB. On edge networks, bandwidth-constrained deployments, or CI/CD pipelines that spin up hundreds of instances, that's real time and money saved. The security win is quieter but bigger—fewer packages means fewer CVEs to patch and fewer attack vectors.
Trade-off: you lose SSH access and debugging tools. That's intentional. If you need a shell inside production, you've already lost.
Share kit
Distroless: 90% smaller, same code
Google's container images strip the OS. Keep the runtime, lose 400MB of bloat. Fast deploys, smaller attack surface, real savings once you're shipping at scale.
your docker image is 500MB because it's shipping an entire OS inside it. distroless strips that down to 50MB—same app, zero OS cruft. 90% smaller. fewer CVEs. faster edge deploys. if you're containerizing, this is the move.
Production shipping at scale? Your Docker images are probably bloated. Distroless (from Google) removes the OS layer—you get language runtimes + your code, nothing else. Result: 90% smaller images, tighter security posture, faster deployments on bandwidth-constrained infrastructure. Mature pattern, worth running the numbers on.
Just realized our Docker images were carrying around 90% bloat we didn't need. Switched to distroless and cut our image sizes by half overnight. Distroless strips everything but your app and its runtime—no OS, no package manager, no attack surface. Google's been shipping these since 2017, but it finally clicked for us why this matters: → Smaller images = faster deploys, especially on edge infra where bandwidth isn't free → Fewer CVEs to patch because there's just... less to exploit → Faster cold starts when you're pulling images at scale If you're containerizing anything serious, this is table stakes. Drop distroless into your FROM line and watch your security posture and deployment speed both improve. GitHub: https://github.com/GoogleContainerTools/distroless
spent an hour yesterday wondering why our docker images were 800MB. switched to distroless, now they're 400MB. turns out you don't need a full OS just to run a Node app. https://github.com/GoogleContainerTools/distroless