90% of Container Images Lack Security Due to Distroless Practices

Building Docker images is straightforward, but perfecting them remains an art. Developers often aim for the smallest, most secure, and functional container images, leading to distroless practices. These practices, however, can create security issues. A significant 90% of container images built with distroless methods lack proper security measures because they bypass package managers. Package managers are crucial as most vulnerability scanners depend on their metadata to identify software components within the container image. Without this, detecting vulnerabilities becomes challenging. Despite the ease of building container images with tools like Docker, Rockcraft, and Buildah, the complexity of distroless strategies often results in error-prone trimming and a lack of deep distro knowledge, contributing to a security abyss in container environments.

Source: towardsdatascience.com