3 ms·

Do you really see that much of a runtime gain with scratch images (or distroless, same general idea) to justify using them? Not a criticism, I’m genuinely curio

• hifromwork 2y ago
  Main goal of using distroless containers is increased security. Runtime gain is kind of a nice benefit you get for free. Security gains from distroless containers come in two flavours: * Reduced attack surface from some vectors, especially they make the container resistant against many common RCE exploits (almost all RCE attacks end up executing shell from the host, and shell is missing by design from distroless containers). Similarly, many in-container privilege escalation attacks are thwarted by this. * Drastically reduced numer of vulnerabilities reported by security scanners. This makes compliance people happy, even though it doesn't really increase security by itself.
• kevincox 2y ago
  The runtime gain is probably near zero. But there are a handful of advantages. 1. Smaller images. This reduces storage cost, pull time, setup time and can potentially allow more active images to be cached on your nodes. 2. Less installed means less for security scanners to trip on. Even if some software is unused it is good practice, and me be a compliance requirement to update with a fix. If it isn't installed there is no worry. 3. Simplicity. You know that things that aren't installed aren't causing issues. So tiny images can be easier to debug.