A Journey to Distroless
summary
Distroless container images are presented as a concrete way to cut system CVEs by roughly 60–70% by using minimal OS layers. The talk demonstrates creating a security layer with Copacetic Patch Layer and building reproducible images with epko/apko that produce SBOMs, showing measured examples (e.g., a 6–15 MB Wolfy base with zero CVEs vs UBI8 at 205 MB with CVEs, and final app images 308 MB on Wolfy vs 543 MB with Maven latest).
AI-written summary · about
chapters (15)
- 0:00Docker vulnerability problem
- 5:22Distroless images
- 7:16Google's distroless variants
- 10:44Distroless challenges
- 11:07Distroless limitations
- 12:55Alternatives to distroless
- 13:38Runtime vulnerabilities
- 16:30Repository and apko utility
- 17:56apko demo: Alpine and Wolfi
- 22:38apko demo: Java with JDK
- 24:01Java multistage build demo
- 26:52Distroless vs traditional images
- 28:16Q&A
- 36:49Distroless security
- 38:54Conclusion
related talks
24mStart Securing your Base Images by Making your Own Distroless
33mDistroless Images: Failing the last mile
40mJIB and Distroless: shrinking sizes and vulnerabilities
47mMission Possible: The 45-Minute Path to Bullet-Proof Java Container Images
33mBuilding Images For The Secure Supply Chain
40m"Willy Wonka and the Secure Container Factory"
50mContainer Attack Surface Reduction Beyond Name Space Isolation
32mSponsored Session: A New Security Standard for the AI Era: Zero-CVE and Real-Time Threat…