Distroless Base Image

A set of defensive configurations designed to prevent a process from escaping the container isolation boundary to the host. Even with a distroless base image, a kernel vulnerability could allow breakout. Key controls include:

• Seccomp profiles to filter dangerous system calls
• User namespace remapping to map root inside the container to an unprivileged host user
• Capability dropping to remove unnecessary Linux capabilities like CAP_SYS_ADMIN
• Read-only root filesystems to prevent attackers from writing persistence mechanisms

A security profile that blocks all system calls by default for a containerized process, explicitly allowing only a minimal set required for the application to function. When combined with a distroless image that lacks a shell, the attack surface shrinks dramatically. A typical ML inference container might only need:

• read, write, openat for model loading
• futex for threading
• mmap for memory allocation
• clock_gettime for performance metrics All other syscalls—including execve, ptrace, and socket—are blocked by default.

The practice of referencing a container image by its immutable content-addressable SHA256 hash rather than a mutable tag like :latest or :distroless. This guarantees that the exact same artifact is deployed every time, preventing supply chain attacks where a tag is overwritten with a malicious image. Example:

• ❌ gcr.io/distroless/static:latest
• ✅ gcr.io/distroless/static@sha256:a1b2c3d4... Digest pinning ensures that even if a registry is compromised, your deployment will fail rather than run untrusted code.

A deploy-time security control that enforces cryptographic signature validation, ensuring only trusted and verified container images are allowed to run in a production environment. For distroless images, this means:

• The image must be signed by a trusted authority (e.g., via Sigstore keyless signing)
• The admission controller verifies the signature before the pod is created
• Unsigned or tampered images are rejected at deploy time, not runtime This creates a trusted supply chain from build to production, complementing the reduced attack surface of distroless images.

A Kubernetes-native plug-in that intercepts authenticated API requests to the cluster, enforcing custom security policies and validations before objects are persisted and executed. For distroless deployments, admission controllers can enforce:

• Image policy: Only allow images from approved registries with verified signatures
• Pod Security Standards: Enforce restricted profile that requires read-only root filesystem and drops all capabilities
• Resource limits: Prevent denial-of-service by requiring CPU and memory limits
• Provenance verification: Check that the image's SLSA provenance meets required build integrity levels

A deployment paradigm where servers and containers are never modified after provisioning. Any configuration change requires destroying the existing component and replacing it with a new, validated version. Distroless images are the natural container expression of this principle:

• No package manager means no apt-get install or yum update inside running containers
• No shell means no interactive debugging sessions that could introduce drift
• Any patch requires rebuilding the entire image, ensuring reproducibility and auditability This eliminates configuration drift and ensures every running instance matches the known-good artifact.