Distroless and Multi-Stage Builds: Smaller, Safer Images

Fri, 19 Dec 2025 15:07:00 +0000

The first Docker image I ever built for a small Go service was 900 megabytes. The compiled binary inside it was eleven. Everything else — the Go toolchain, a full Debian userland, a package manager, a shell, compilers, a hundred libraries the binary never touched — came along for the ride because I had done the obvious thing and built the image FROM golang. It worked. It was also a comically oversized attack surface wrapped around a program that needed almost none of it, and every one of those hundred unused libraries was something a scanner could find a CVE in.

Distroless - vo.rs

Distroless and Multi-Stage Builds: Smaller, Safer Images