distroless static (the smallest one, https://github.com/GoogleContainerTools/distroless/tree/main/base https://github.com/GoogleContainerTools/distroless/tree/m

distroless static (the smallest one, https://github.com/GoogleContainerTools/distroless/tree/main/base https://github.com/GoogleContainerTools/distroless/tree/main...) is about 4 MB. It contains things like: /usr/share/zoneinfo/<timezones> /etc/ssl/certs/ca-certificates.crt /etc/debian_version ... not much else really. On the other hand, scratch is a special image that contains literally nothing, 0 bytes. Docker doesn't have to talk to the network to download it, it doesn't have to be built, it's just a tarball of nothing. scratch is thus infinitely smaller than distroless since it has no size. It's also not suitable for rust since rust applications will commonly link against openssl for tls, against a libc implementation for things like network operations and threads, and so on.