Distroless Images: Failing the last mile
summary
Explains why Distroless images alone fail for many apps and shows a practical pipeline using multi-stage Docker builds, buildpacks and especially Nix overlays to produce reproducible OCI images with supply-chain provenance. Demonstrates iterative fixes: bumping OpenSSL then curl drops reported vulnerabilities from 17 → 5 → 3 CVEs, and replacing OpenSSL with a rustls replacement removes more TLS risk. Builds succeed and scanners show materially fewer CVEs, though some upstream fixes remain required.
AI-written summary · about
chapters (23)
- 0:00Introduction
- 1:07Vulnerabilities in packages
- 3:11Case study: 100 microservices, 10k vulns
- 4:39Distroless limits for dynamic apps
- 6:02Improving Distroless images
- 6:44Distroless image ingredients
- 8:50Supply chain security challenges
- 10:35Alternatives to Dockerfiles
- 11:39Buildpacks and other tools
- 13:28Nix for reproducible builds
- 15:15Nix to generate Distroless images
- 16:39Nix builds to container images
- 17:21Vulnerability scanning results
- 19:05Bumping OpenSSL and curl
- 20:52Replacing OpenSSL with Rustls
- 25:31Dropping OpenSSL entirely
- 27:41Memory-safe TLS backends
- 28:03Supply chain security takeaways
- 29:05Focus on supply chain tools
- 29:25Bazel and Debian alternatives
- 30:29Nix with other tools hybrid
- 31:36Organizational tool trends
- 32:20References and closing
related talks
39mA Journey to Distroless
24mStart Securing your Base Images by Making your Own Distroless
34mDelivering Continuous Security with Docker
35mSecuring Containers by Breaking In
38mSo. Many. Vulnerabilities. Why are containers such a mess...
30mRootless, Reproducible, and Hermetic: Secure Container Build Showdown
46mAdding security for reliable continuous delivery
32mSecure containers - Michael Wager and Michael Helwig