5.1The Principle: Every Unnecessary Package Is an Attack Surface

Every binary, library, and shell in a container image is a potential vulnerability waiting to be discovered. A full Ubuntu base image ships with hundreds of packages your application never uses -- but an attacker can exploit any of them. Minimal images reduce your attack surface, shrink download times, and cut storage costs.

The goal is simple: your container should contain your application and its runtime dependencies, nothing else.