Atlas › 08 Infrastructure as Code Testing › Minimal Container Images☰ Read as one page
Minimal Container Images
5.1The Principle: Every Unnecessary Package Is an Attack SurfaceEvery binary, library, and shell in a container image is a potential vulnerability waiting to be discovered. A full Ubuntu base image ships…5.2Image Size and Vulnerability ComparisonThe difference between 200 CVEs and 0 CVEs is not about better patching -- it is about having fewer things to patch. Distroless images…5.3Multi-Stage Builds: The FoundationMulti-stage builds separate the build environment from the runtime environment. Your build stage can have compilers, package managers, and…5.4Distroless Images: The Sweet SpotGoogle's distroless images contain only the language runtime and your application. No shell, no package manager, no OS utilities. This…5.5Alpine Images: Smaller but with TradeoffsAlpine Linux uses musl libc instead of glibc, which causes compatibility issues with some applications. Understand the tradeoffs before…5.6Security Hardening ChecklistBeyond choosing a minimal base image, apply these hardening practices:5.7Testing Minimal ImagesVerify your minimal images meet security requirements: