distroless
also: minimal image, scratch-based image
A container image that contains only an application and its runtime dependencies, with no package manager, shell, or other OS utilities typically found in Linux distributions.
Distroless images are minimal container images that strip away the traditional Linux distribution layer—including the package manager, shell, coreutils, and other tools—leaving only what's absolutely necessary to run your application.
These images are built by starting with a base layer (often just libc and other C runtime libraries) and adding only the application binaries and their direct dependencies. For example, a distroless image for a Go application might be just a few megabytes, containing only the compiled Go binary and minimal runtime files.
The main benefits are smaller image size, reduced attack surface (fewer tools for an attacker to exploit), and faster deployments. However, debugging is harder since there's no shell or system utilities available. Distroless images are commonly used in production container environments like Kubernetes, particularly with Google's publicly available distroless base images.