#distroless — Public Fediverse posts

Многоэтапные сборки в Docker: как уменьшить образ с 1,2 ГБ до 50 МБ

Знакомая картина: вы написали микросервис, набросали Dockerfile из четырёх команд — и получили образ на 1,2 ГБ. В единичном случае не страшно, но этот гигабайт гоняется по сети десятки раз в день: при каждом коммите в CI, на preview-окружениях, при деплое в кластеры. В итоге — минуты ожидания пайплайнов, счета за трафик и хранение, плюс лишние системные пакеты с десятками CVE. Показываем на Node.js и Go, как ужать образ с 1,2 ГБ до 50 МБ через multi-stage — без единой строчки правок в коде. Раскатать без боли →

https://habr.com/ru/companies/netologyru/articles/1051714/

#docker #multistage_builds #dockerfile #оптимизация_Dockerобраза #alpine_linux #nodejs #контейнеризация #buildkit #distroless #cicd

Как дебажить distroless-контейнер в Kubernetes без shell: ephemeral containers на практике

Статья о том, как дебажить distroless-контейнеры в Kubernetes, когда внутри нет ни shell, ни привычных утилит. Разбираем ephemeral containers на практике: зачем они нужны, как помогают во время инцидента, где легко ошибиться с файловой системой, процессами, DNS и TLS, и почему нормальная отладка должна жить в платформе, а не внутри боевого образа.

https://habr.com/ru/articles/1040748/

#devops #kubernetes #observability #дебаг #девопс #distroless #ephemeral #кубер #docker #dockerfile

Fedora presenta 🐦 #Hummingbird! Una nova proposta d'imatges de contenidor #distroless. 📦

L'objectiu és oferir entorns minimalistes, molt més segurs i lleugers, eliminant components innecessaris com shells o gestors de paquets. 🛡️⚡ Una gran notícia per a l'ecosistema #CloudNative i la seguretat en #Linux.

Tota la info aquí: https://www.muylinux.com/2026/05/13/fedora-hummingbird-distroless/

#Fedora #Containers #Security #OpenSource #TechNews #SysAdmin

Fedora presenta 🐦 #Hummingbird! Una nova proposta d'imatges de contenidor #distroless. 📦

L'objectiu és oferir entorns minimalistes, molt més segurs i lleugers, eliminant components innecessaris com shells o gestors de paquets. 🛡️⚡ Una gran notícia per a l'ecosistema #CloudNative i la seguretat en #Linux.

Tota la info aquí: https://www.muylinux.com/2026/05/13/fedora-hummingbird-distroless/

#Fedora #Containers #Security #OpenSource #TechNews #SysAdmin

It for me? 🥺👉👈

Honestly, that it took this long ^^; We all know about #Wolfi & #ChainGuard bringing secure, #distroless container images to the masses - as they've been doing that for a couple of years now.

But #Fedora upping the ante by giving you a slim container base WITH all the solid RPMs they package is great! It adds competition and gives alternatives to the user - so yay!

Fedora Hummingbird Introduces a Container-Native Rolling Linux Variant
https://linuxiac.com/fedora-hummingbird-introduces-a-container-native-rolling-linux-variant/

It for me? 🥺👉👈

Honestly, that it took this long ^^; We all know about #Wolfi & #ChainGuard bringing secure, #distroless container images to the masses - as they've been doing that for a couple of years now.

But #Fedora upping the ante by giving you a slim container base WITH all the solid RPMs they package is great! It adds competition and gives alternatives to the user - so yay!

Fedora Hummingbird Introduces a Container-Native Rolling Linux Variant
https://linuxiac.com/fedora-hummingbird-introduces-a-container-native-rolling-linux-variant/

Something new out of Red Hat! Project Hummingbird, a zero-cve platform.

https://www.redhat.com/en/about/press-releases/red-hat-introduces-project-hummingbird-zero-cve-strategies

#zerocve #containers #distroless #cloud

Something new out of Red Hat! Project Hummingbird, a zero-cve platform.

https://www.redhat.com/en/about/press-releases/red-hat-introduces-project-hummingbird-zero-cve-strategies

#zerocve #containers #distroless #cloud

#Distroless #OCI containers to replace #Bitnami images. Governments explore different options: #Nix_Flakes custom builds, community images.

Read my take and another option based on #Fedora at https://blog.riemann.cc/digitalisation/2025/10/26/distroless-containers-nix-flakes-vs-fedora/

What is your view?

#opensuse #podman #NixOS #digitialsovereignty #supplychain #NIS2

#Distroless #OCI containers to replace #Bitnami images. Governments explore different options: #Nix_Flakes custom builds, community images.

Read my take and another option based on #Fedora at https://blog.riemann.cc/digitalisation/2025/10/26/distroless-containers-nix-flakes-vs-fedora/

What is your view?

#opensuse #podman #NixOS #digitialsovereignty #supplychain #NIS2

Distroless приложения (VM/bare-metal)

Некоторые языки программирования (например, Go и Zig) позволяют собрать приложение без каких-либо зависимостей, в том числе отвязаться от libc, тем самым создание distroless-контейнера на Go становится тривиальной задачей. Но эта же особенность может быть применена не только для создания контейнера, но и для запуска такого приложения в VM или на реальном хосте не используя какой-либо дистрибутив Linux, а используя только ядро Linux и само приложение, построенное с помощью Go (или, например, Zig). Такая возможность позволяет избавиться от дополнительных зависимостей, которые добавляют потенциальные риски с точки зрения атаки на цепочку поставок (supply chain attack).

https://habr.com/ru/articles/949168/

#distroless #embedded #supply_chain_attack

Защищаем контейнеры с нуля: практическое руководство по Docker security и Kubernetes security contexts

Привет, Кореша! Вы когда-нибудь задумывались о безопасности контейнеров, работающих в продакшене? Docker и Kubernetes предоставляют широкий набор инструментов, которые могут быть использованы плохими людьми. Безопасность контейнеров — это не просто волшебная защита, а многослойная система, охватывающая весь процесс от сборки до запуска в кластере. В этой статье мы разберем практические шаги по защите ваших контейнеров, от написания безопасного Dockerfile до настройки политик безопасности в Kubernetes.

https://habr.com/ru/articles/944608/

#docker #kubernetes #security #pod_security_admission #distroless

Docker launches #DockerHardenedImages (DHI) – a security-focused set of base images designed to cut vulnerabilities by up to 95%.

Using a #distroless approach, DHI removes unnecessary components, supports automatic patching, and remains compatible with existing Dockerfiles.

🔎 More on #InfoQ: https://bit.ly/4nfy3TB

#DevOps #SecurityVulnerabilities #Docker

Docker launches #DockerHardenedImages (DHI) – a security-focused set of base images designed to cut vulnerabilities by up to 95%.

Using a #distroless approach, DHI removes unnecessary components, supports automatic patching, and remains compatible with existing Dockerfiles.

🔎 More on #InfoQ: https://bit.ly/4nfy3TB

#DevOps #SecurityVulnerabilities #Docker

We have a canary build of our @nlnetlabs #unbound #docker image with #quic support available for testing, yay! 💚

➡️ madnuttah/unbound:canary-quic ⬅️

https://github.com/madnuttah/unbound-docker/

https://hub.docker.com/r/madnuttah/unbound

#selfhosting #homelab #opensource #foss #dnssec #doq #dnsoverquic #quictls #distroless

We have a canary build of our @nlnetlabs #unbound #docker image with #quic support available for testing, yay! 💚

➡️ madnuttah/unbound:canary-quic ⬅️

https://github.com/madnuttah/unbound-docker/

https://hub.docker.com/r/madnuttah/unbound

#selfhosting #homelab #opensource #foss #dnssec #doq #dnsoverquic #quictls #distroless

Безопасность Kubernetes-кластеров: вредные советы или bullshit bingo

Как погубить кластер, действуя во благо? Подборка вредных советов из реальных кейсов и опыта от специалиста по безопасности контейнеров и Kubernetes. Вместе установим антивирус на ноды, просканируем хостовую ОС и заблокируем выкатки образов с чувствительной информацией. Привет, Хабр! Меня зовут Дмитрий Евдокимов. Я — Founder & CTO Luntry в компании по созданию решений для безопасности контейнеров и Kubernetes, CFP конференций DevOpsConf и Highload, автор курса «Cloud-Native безопасность в Kubernetes» и телеграм-канала k8s (in) security. Эта статья написана по мотивам моего доклада для DevOpsConf 2024. Так как я проработал в сфере информационной безопасности больше 15 лет и специализируюсь именно на безопасности контейнеров и кластеров, дам несколько «вредных» советов, как сделать Kubernetes-кластер «безопасным». Погубить кластер

https://habr.com/ru/companies/oleg-bunin/articles/875114/

#кубернетес #контейнеры #оркестрация_микросервисов #окружение #shift_left_security #уязвимости #distroless #zerotrust #NetworkPolicy #apparmor

Tired of seeing bullshit alerts about dependencies in your containers, which have some crazy new vulnerability, but aren't part of your application and don't really need to be there? Me too! Stop wasting time and start getting actionable security feedback by making your containers distroless!

I tested this and was able to reduce the number of dependencies showing up in my SBOM by *71%* compared to python:3.11-slim!

https://chris.partridge.tech/2024/distroless-python-in-minutes/ #distroless #container #docker

Tired of seeing bullshit alerts about dependencies in your containers, which have some crazy new vulnerability, but aren't part of your application and don't really need to be there? Me too! Stop wasting time and start getting actionable security feedback by making your containers distroless!

I tested this and was able to reduce the number of dependencies showing up in my SBOM by *71%* compared to python:3.11-slim!

https://chris.partridge.tech/2024/distroless-python-in-minutes/ #distroless #container #docker

#Distroless Images in Docker: Minimalism, Security, and Debugging in #Kubernetes

https://ozeranskii.medium.com/distroless-images-in-docker-minimalism-security-and-debugging-in-kubernetes-339a9b4421fa

#Distroless Images in Docker: Minimalism, Security, and Debugging in #Kubernetes

https://ozeranskii.medium.com/distroless-images-in-docker-minimalism-security-and-debugging-in-kubernetes-339a9b4421fa

This video is 7 years old, yet still relevant and important!

2017 swampUP Sessions | Distroless Docker: Containerizing Apps, not VMs https://youtu.be/lviLZFciDv4

Invidious: https://inv.nadeko.net/watch?v=lviLZFciDv4

#docker #distroless #swarpUP #devops

This video is 7 years old, yet still relevant and important!

2017 swampUP Sessions | Distroless Docker: Containerizing Apps, not VMs https://youtu.be/lviLZFciDv4

Invidious: https://inv.nadeko.net/watch?v=lviLZFciDv4

#docker #distroless #swarpUP #devops

Краткий дайджест обновлений Deckhouse Kubernetes Platform 1.48-1.60

В этой статье мы рассмотрим самые важные обновления Deckhouse Kubernetes Platform версий 1.48–1.60, произошедшие почти за год — именно столько времени прошло с момента выхода нашего последнего обзора новых фичей.

https://habr.com/ru/companies/flant/articles/826228/

#kubernetes #deckhouse #Deckhouse_Kubernetes_Platform #devops #istio #grafana #distroless #обновления #platform_engineering #отечественное_по

[Перевод] Что находится внутри образов distroless-контейнеров

Базовые distroless-образы GoogleContainerTools часто упоминаются как один из способов создания (более) маленьких, (более) быстрых и (более) безопасных контейнеров. Но что на самом деле они собой представляют? Зачем они нужны? В чем разница между контейнером, созданным на distroless-базе, и контейнером, созданным с нуля? Давайте разберёмся.

https://habr.com/ru/companies/flant/articles/822427/

#distroless #контейнеры #контейнеризация #k8s #kubernetes #containers #devops #docker #образы #scratch

Just published a blog post on why I migrated my personal website from Next.js to Eleventy.

https://www.mattknight.io/blog/migrating-from-nextjs-to-eleventy

It's fairly high-level, but I'll be following up on some deep dives into some of the more nuanced parts of my new setup - like the distroless nginx container and the VPN setup letting me host the website from my office.

#blog #website #nextjs #eleventy #selfhosting #selfhosted #vpn #wireguard #distroless #docker #nginx #webdesign #webdev

Just published a blog post on why I migrated my personal website from Next.js to Eleventy.

https://www.mattknight.io/blog/migrating-from-nextjs-to-eleventy

It's fairly high-level, but I'll be following up on some deep dives into some of the more nuanced parts of my new setup - like the distroless nginx container and the VPN setup letting me host the website from my office.

#blog #website #nextjs #eleventy #selfhosting #selfhosted #vpn #wireguard #distroless #docker #nginx #webdesign #webdev

Finally launched my new #blog #website https://www.mattknight.io/

There's still a lot to be done, but I'm really happy with it so far.

A few highlights:
- built with #eleventy
- deployed in #distroless #Docker image using #nginx (total image size <10MB)
- pre-compressed (br + gzip) files
- works w/o JS (menu stays open)
- mobile first w/ progressive enhancement
- tiny (<4KiB home, <7KiB for blog post) + very fast!
- perfect #lighthouse score
- supports dark mode
- served from my office server

Finally launched my new #blog #website https://www.mattknight.io/

There's still a lot to be done, but I'm really happy with it so far.

A few highlights:
- built with #eleventy
- deployed in #distroless #Docker image using #nginx (total image size <10MB)
- pre-compressed (br + gzip) files
- works w/o JS (menu stays open)
- mobile first w/ progressive enhancement
- tiny (<4KiB home, <7KiB for blog post) + very fast!
- perfect #lighthouse score
- supports dark mode
- served from my office server

Wasn't too much work, so the #OpenSSL build environment got implemented into my @nlnetlabs #unbound #docker image already. You had my promise. The initial build was manual but it should run as an #automatedBuild too.

The first madnuttah/unbound-docker #distroless build (v1.19.3-1) with the per architecture optimized libraries is available on #dockerHub. 💚

https://github.com/madnuttah/unbound-docker

https://hub.docker.com/r/madnuttah/unbound

#dns #dnssec #homelab #selfhosting

Wasn't too much work, so the #OpenSSL build environment got implemented into my @nlnetlabs #unbound #docker image already. You had my promise. The initial build was manual but it should run as an #automatedBuild too.

The first madnuttah/unbound-docker #distroless build (v1.19.3-1) with the per architecture optimized libraries is available on #dockerHub. 💚

https://github.com/madnuttah/unbound-docker

https://hub.docker.com/r/madnuttah/unbound

#dns #dnssec #homelab #selfhosting

Recently revisited `kubectl debug`.

I am amazed how powerful ephemeral containers have become in #kubernetes 🎉

You can easily access
* file system,
* network and
* processes
of other containers in the pod.

🔐 No more reasons not to use #distroless containers !

#kubectl

Wolfi: a Community Linux OS Designed for the Container and Cloud-Native Era: https://github.com/wolfi-dev
#linux #update #foss #release #distro #distroless #wolfi #cloud #container

Anyways, the last part of today's research dive was more #Docker.

The most interesting discovery was #distroless images. I was familiar with #Alpine #Linux, but I hadn't really stumbled across distroless yet. Specifically I noticed that #Envoy shipped a distroless image, but neglected to really explain it short of "it's faster and better".

Google's distroless project is limited to standalone application runners (Node, Java), but #ChainGuard has their #Wolfi images that cover more bases. 👍

Anyways, the last part of today's research dive was more #Docker.

The most interesting discovery was #distroless images. I was familiar with #Alpine #Linux, but I hadn't really stumbled across distroless yet. Specifically I noticed that #Envoy shipped a distroless image, but neglected to really explain it short of "it's faster and better".

Google's distroless project is limited to standalone application runners (Node, Java), but #ChainGuard has their #Wolfi images that cover more bases. 👍

Fearless #Distroless https://blog.frankel.ch/fearless-distroless/

#containers #debug #devops #kubernetes

Fearless #Distroless https://blog.frankel.ch/fearless-distroless/

#containers #debug #devops #kubernetes

It all started with a commit: Celebrating 6 years of #Distroless https://www.chainguard.dev/unchained/celebrating-6-years-of-distroless

It all started with a commit: Celebrating 6 years of #Distroless https://www.chainguard.dev/unchained/celebrating-6-years-of-distroless

Current status: trying #bun (#javascript runtime) because it has HTMLRewriter 😂
https://bun.sh/docs/api/html-rewriter

Unfortunately they don't have *musl* build so it's quite a hassle to get it work on #alpinelinux and #distroless 🙁

Current status: trying #bun (#javascript runtime) because it has HTMLRewriter 😂
https://bun.sh/docs/api/html-rewriter

Unfortunately they don't have *musl* build so it's quite a hassle to get it work on #alpinelinux and #distroless 🙁

How to use and build your own #Distroless images?
Read @sselzer new blog post to find out some answers.

https://www.innoq.com/en/blog/how-to-use-and-build-your-own-distroless-images/

How to use and build your own #Distroless images?
Read @sselzer new blog post to find out some answers.

https://www.innoq.com/en/blog/how-to-use-and-build-your-own-distroless-images/

“Distroless” does not immediately mean 100% secure.

Exploiting Distroless Images »
https://www.form3.tech/engineering/content/exploiting-distroless-images

#articles #security #distroless #ContainerSecurity

“Distroless” does not immediately mean 100% secure.

Exploiting Distroless Images »
https://www.form3.tech/engineering/content/exploiting-distroless-images

#articles #security #distroless #ContainerSecurity

“Distroless” does not immediately mean 100% secure.

Exploiting Distroless Images »
https://www.form3.tech/engineering/content/exploiting-distroless-images

#articles #security #distroless #ContainerSecurity