5 Opinions on Distroless Images for Java Apps in 4 Minutes

Transcript

Hi friends! Let’s discuss facts and fiction related to distroless images.

There’s no Linux in distroless.

Fact or fiction?

Truly distroless images are made FROM scratch, but they are suitable for simple statically linked apps. Not all enterprise apps can be run from scratch as there is no certificate data or other necessary components.

So, ready distroless images do contain a Linux distro, but a very stripped-down one, without a package manager, shell, or other typical Linux components. This approach is in line with the modern practices of running an application in the immutable container.

The answer is: fiction

Distroless are smaller than the usual Docker images.

Fact or fiction?

There are distroless images as small as two MB. They are great for statically linked apps. For the applications with dynamic features, there are distroless images with libc: Debian glibc from google, and Wolfi glibc and Alpine musl from Chainguard, for instance. They, too, are quite small. But If you have a Java app, you need a JRE. So the distroless image for Java includes a libc plus an OpenJDK distribution, and so it is a lot bigger.

The answer is: fact, but not for Java apps

Distroless are more secure than the usual Docker images.

Fact or fiction?

It is said that distroless have a smaller attack surface. However, the attack surface is not the sum of all software components but of attack vectors — the potentially exploitable paths. It means that not all files in your container can be used by attackers. Files in the direct execution path, such as libc, for instance, are at a higher risk of exploits.

Even though distroless are smaller, they are still not foolproof. They contain a Linux distro and an OpenJDK distribution in the case of Java apps, so if these components are not secure - the image will be insecure too. The answer is: fiction

Distroless are difficult to debug.

Fact or fiction?

Distroless containers are hard to debug due to the absence of shell access. You need to master advanced Kubernetes techniques or introduce other technologies into your project, such as ephemeral containers. Besides, if your app doesn’t fit perfectly into a ready image, configuration of distroless images is not that simple either. To adjust Google's images, for example, you need to know bazel, and adding new packages is complicated without a package manager. The answer is: fact

Distroless images are a good choice for enterprise applications.

Fact or fiction?

Distroless are good for specific cases. Statically linked applications will benefit from small images, plus popular distroless images from Google or Chainguard are established and reliable.

But in the case of Java, choosing a right base image for your Java app might be better. Consider a secure Liberica Runtime Container, which is only about 40 MB in size and based on Liberica JDK and Alpaquita Linux. The answer is: fact, but not for all use cases

And these were five opinions on distroless images. To find out more, read our FAQ on this solution. The link is in the description.

Do you consider using distroless for your application? What do you think is better, distroless or a lightweight base OS image for containers? Share your thoughts in the comments.