The distroless repository provides minimal Docker container images that contain only an application and its runtime dependencies, with no package managers, shells, or other programs typically found in standard Linux distributions. Built primarily in Starlark and leveraging Bazel as its build system, the project addresses a fundamental container security and efficiency concern by reducing attack surface area and image size.
The smallest distroless image, gcr.io/distroless/static-debian13, weighs approximately 2 MiB, roughly 50 percent of Alpine's size and less than 2 percent of Debian's footprint. This dramatic size reduction improves signal-to-noise ratios for vulnerability scanners and CVE detection while simplifying provenance establishment by limiting what needs to be tracked to only essential dependencies.
Distroless offers language-focused base images across multiple runtime environments. For Debian 13, the project publishes static, base, base-nossl, and cc variants, alongside language-specific images for Java 17, 21, and 25, Node.js versions 22, 24, and 26, and Python 3. Debian 12 variants remain available for static, base, base-nossl, and cc images. These images support multiple architectures including amd64, arm64, arm, s390x, ppc64le, and riscv64, with architecture-specific tags available for direct reference. Each image variant includes latest, nonroot, debug, and debug-nonroot tag options.
The repository implements automatic security updates through GitHub Actions workflows that generate pull requests when upstream Debian releases include patches. All distroless images are signed using cosign with ephemeral keyless signatures, enabling users to verify image authenticity before building. Debug variants provide busybox shell access for troubleshooting while maintaining the minimal footprint of production images.
Usage patterns support both Docker multi-stage builds and Bazel-based workflows. Docker users perform multi-stage builds with one stage for application compilation and another inserting artifacts into distroless runtime images. Bazel users reference the bazel-contrib/rules_oci repository for full container image generation documentation and the GoogleContainerTools/rules_distroless repository for custom image creation guidance. The project provides examples for Java, Python 3, Go, Node.js, and Rust applications.
According to GitGenius activity tracking, the repository demonstrates median issue and pull request response latency of 5.3 hours across 199 tracked items, with loosebazooka as the most active contributor recording 517 events. Enhancement requests represent the most frequently tracked issue label category. The project maintains connections with related container orchestration ecosystems through overlapping contributors with argoproj/argo-workflows, argoproj/argo-cd, and apache/beam repositories.
Notable adopters include Kubernetes since version 1.15, Knative, Tekton, Teleport, BloodHound by SpecterOps, and K8gb. The project maintains community engagement through a distroless-users Google Group and a dedicated Kubernetes Slack channel. Images are served through artifact registry infrastructure while maintaining the gcr.io domain for backward compatibility, allowing users to benefit from newer infrastructure without modifying their builds.
