A typical Node image ships a shell, a package manager and hundreds of libraries the application never calls. Distroless removes them — and removes a class of exploit with them.
Start from a full distribution base image and you inherit a shell, a package manager, curl, and a long tail of libraries. Your application uses almost none of it. An attacker who achieves code execution uses nearly all of it.
Distroless and minimal base images invert that. No shell means no reverse shell. No package manager means no installing tools post-compromise. The CVE count drops sharply, not because the code is more secure but because most of the code is simply gone.
The baseline we apply
- Multi-stage builds — compile with the full toolchain, ship only the artefact
- Run as a non-root user with a read-only root filesystem
- Pin base images by digest, not by tag; tags move underneath you
- Drop all Linux capabilities and add back only what the workload provably needs
- No secrets in build args — they persist in the layer history regardless of what you do later
The objection, and the answer
Teams push back because they lose the ability to exec into a container and poke around. That is the point. The replacement is ephemeral debug containers, which attach a toolchain when a human needs one and leave nothing behind in the running image. It is a workflow change, and it is worth it.