In this lesson, you will learn how to harden your production environment by migrating your final runtime stage to a "Distroless" image, effectively removing the tools that attackers rely on.
The Problem with Standard Base Images
When you use a standard base image like ubuntu or even alpine for your production runtime, you are carrying a significant amount of "baggage." These images contain package managers (like apt or apk), shell environments (like bash or sh), and various utility binaries (like curl or netcat).
If an attacker manages to exploit a vulnerability in your application and gains remote code execution, their first move is often to use these pre-installed tools to explore your container, download malicious scripts, or pivot deeper into your infrastructure. In a production runtime, your application rarely needs a shell; it only needs your binary and its runtime dependencies.
Moving to Distroless
Distroless images, maintained by Google, contain only your application and its language-specific dependencies. They do not contain shells, package managers, or any extraneous programs. If an attacker gains access to a Distroless container, they find themselves in a "sandbox" with no tools to interact with, making it significantly harder to escalate an attack.
Here is how you swap your final stage to a Distroless base:
# Stage 1: Build your app
FROM golang:1.21 AS builder
WORKDIR /app
COPY . .
RUN go build -o my-app
# Stage 2: Final runtime
FROM gcr.io/distroless/static-debian12
COPY --from=builder /app/my-app /my-app
ENTRYPOINT ["/my-app"]
By switching from a full-featured image to gcr.io/distroless/static-debian12 (or the language-specific variant like gcr.io/distroless/nodejs), you strip away the entire attack surface provided by the underlying OS utilities. Because there is no shell, you also force yourself to ensure your application handles configuration via environment variables or mounted files, rather than manual "tinkering" inside the container. This shift makes your deployment more secure and enforces cleaner operational practices.
Key Takeaway: Distroless images eliminate unnecessary binaries and shells, turning your production container into a hardened, single-purpose executable environment that leaves attackers with nothing to work with.