mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-08-31 21:50:50 +03:00
Mahipal
6972fe933e
All 33 container-security skills now carry what it does, an explicit "Use when" trigger, keywords, and a negative trigger naming the nearest neighbour. Six collision clusters resolved by differentiating scope rather than merging, so no skill is removed: - kube-bench: running the tool vs interpreting findings into an audit - Calico: portable upstream NetworkPolicy vs Calico-as-CNI vs Calico-only CRDs (GlobalNetworkPolicy, HostEndpoint, DNS egress) - Falco: deploying and operating it vs authoring escape rules - container escape: tool-agnostic runtime signals vs Falco rule syntax vs static posture audit vs offensive breakout - Trivy: all-target platform and operator vs single-image scan - Docker: images and Dockerfiles vs daemon.json vs the CIS audit script Also replaces the templated "When to Use" boilerplate in these files, including bullets that only restated the skill's own name. Worst pair (Pod Security Standards vs Pod Security Admission) drops from 0.77 cosine to below the 0.45 threshold. Repo-wide: colliding pairs 60 -> 56, skills involved 105 -> 94.
222 lines
6.6 KiB
Markdown
222 lines
6.6 KiB
Markdown
---
|
|
name: implementing-container-image-minimal-base-with-distroless
|
|
description: >-
|
|
Reduces container attack surface by building application images on Google distroless base
|
|
images that ship only the application runtime - no shell, package manager, or OS utilities -
|
|
using multi-stage build patterns plus debugging and scanning techniques adapted to
|
|
distroless. Use when hardening container images, cutting attack surface in a container
|
|
architecture, or answering an assessment finding about bloated base images. Keywords:
|
|
distroless, multi-stage build, no shell, nonroot tag, debug image, scratch, attack surface.
|
|
Do not use for scanning an image for known CVEs - use scanning-docker-images-with-trivy.
|
|
domain: cybersecurity
|
|
subdomain: container-security
|
|
tags:
|
|
- distroless
|
|
- container-images
|
|
- minimal-base
|
|
- attack-surface
|
|
- docker
|
|
- security-hardening
|
|
- supply-chain
|
|
- kubernetes
|
|
version: '1.0'
|
|
author: mahipal
|
|
license: Apache-2.0
|
|
nist_csf:
|
|
- PR.PS-01
|
|
- PR.IR-01
|
|
- ID.AM-08
|
|
- DE.CM-01
|
|
mitre_attack:
|
|
- T1610
|
|
- T1611
|
|
- T1609
|
|
- T1525
|
|
- T1195
|
|
---
|
|
|
|
# Implementing Container Image Minimal Base with Distroless
|
|
|
|
## Overview
|
|
|
|
Google distroless images contain only your application and its runtime dependencies, without package managers, shells, or other programs found in standard Linux distributions. By eliminating unnecessary OS components, distroless images achieve up to 95% reduction in attack surface compared to traditional base images like ubuntu or debian. Major projects including Kubernetes itself, Knative, and Tekton use distroless images in production. As of 2025, Docker also offers Hardened Images (DHI) as an open-source alternative for minimal container bases.
|
|
|
|
|
|
## When to Use
|
|
|
|
- When deploying or configuring implementing container image minimal base with distroless capabilities in your environment
|
|
- When establishing security controls aligned to compliance requirements
|
|
- When building or improving security architecture for this domain
|
|
- When conducting security assessments that require this implementation
|
|
|
|
## Prerequisites
|
|
|
|
- Docker 20.10+ or compatible container build tool (Buildah, Kaniko)
|
|
- Multi-stage Dockerfile knowledge
|
|
- Application compiled as a static binary or with runtime bundled
|
|
- Container registry for image storage
|
|
|
|
## Available Distroless Images
|
|
|
|
| Image | Use Case | Size |
|
|
|-------|----------|------|
|
|
| `gcr.io/distroless/static-debian12` | Statically compiled binaries (Go, Rust) | ~2MB |
|
|
| `gcr.io/distroless/base-debian12` | Dynamically linked binaries needing glibc | ~20MB |
|
|
| `gcr.io/distroless/cc-debian12` | C/C++ applications needing libstdc++ | ~25MB |
|
|
| `gcr.io/distroless/java21-debian12` | Java 21 applications | ~220MB |
|
|
| `gcr.io/distroless/python3-debian12` | Python 3 applications | ~50MB |
|
|
| `gcr.io/distroless/nodejs22-debian12` | Node.js 22 applications | ~130MB |
|
|
|
|
## Multi-Stage Build Patterns
|
|
|
|
### Go Application
|
|
|
|
```dockerfile
|
|
# Build stage
|
|
FROM golang:1.22-bookworm AS builder
|
|
WORKDIR /app
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
COPY . .
|
|
RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o /server ./cmd/server
|
|
|
|
# Runtime stage - static distroless
|
|
FROM gcr.io/distroless/static-debian12:nonroot
|
|
COPY --from=builder /server /server
|
|
USER nonroot:nonroot
|
|
ENTRYPOINT ["/server"]
|
|
```
|
|
|
|
### Java Application
|
|
|
|
```dockerfile
|
|
# Build stage
|
|
FROM maven:3.9-eclipse-temurin-21 AS builder
|
|
WORKDIR /app
|
|
COPY pom.xml .
|
|
RUN mvn dependency:go-offline
|
|
COPY src ./src
|
|
RUN mvn package -DskipTests
|
|
|
|
# Runtime stage - Java distroless
|
|
FROM gcr.io/distroless/java21-debian12:nonroot
|
|
COPY --from=builder /app/target/app.jar /app.jar
|
|
USER nonroot:nonroot
|
|
ENTRYPOINT ["java", "-jar", "/app.jar"]
|
|
```
|
|
|
|
### Python Application
|
|
|
|
```dockerfile
|
|
# Build stage
|
|
FROM python:3.12-bookworm AS builder
|
|
WORKDIR /app
|
|
COPY requirements.txt .
|
|
RUN pip install --no-cache-dir --target=/deps -r requirements.txt
|
|
COPY . .
|
|
|
|
# Runtime stage - Python distroless
|
|
FROM gcr.io/distroless/python3-debian12:nonroot
|
|
WORKDIR /app
|
|
COPY --from=builder /deps /deps
|
|
COPY --from=builder /app /app
|
|
ENV PYTHONPATH=/deps
|
|
USER nonroot:nonroot
|
|
ENTRYPOINT ["python3", "/app/main.py"]
|
|
```
|
|
|
|
### Node.js Application
|
|
|
|
```dockerfile
|
|
# Build stage
|
|
FROM node:22-bookworm AS builder
|
|
WORKDIR /app
|
|
COPY package*.json ./
|
|
RUN npm ci --production
|
|
COPY . .
|
|
|
|
# Runtime stage - Node distroless
|
|
FROM gcr.io/distroless/nodejs22-debian12:nonroot
|
|
WORKDIR /app
|
|
COPY --from=builder /app .
|
|
USER nonroot:nonroot
|
|
CMD ["server.js"]
|
|
```
|
|
|
|
## Security Benefits
|
|
|
|
### Attack Surface Comparison
|
|
|
|
| Component | Ubuntu | Alpine | Distroless |
|
|
|-----------|--------|--------|-----------|
|
|
| Shell (bash/sh) | Yes | Yes | No |
|
|
| Package manager | apt | apk | No |
|
|
| coreutils | Full | BusyBox | No |
|
|
| curl/wget | Yes | Yes | No |
|
|
| User management | Yes | Yes | No |
|
|
| Known CVEs (typical) | 50-200+ | 5-20 | 0-5 |
|
|
| Image size (base) | ~77MB | ~7MB | ~2-20MB |
|
|
|
|
### Security Implications
|
|
|
|
- **No shell**: Attackers cannot exec into containers to run commands
|
|
- **No package manager**: Cannot install additional tools or malware
|
|
- **No coreutils**: No `cat`, `ls`, `find`, `curl` for reconnaissance
|
|
- **Minimal CVEs**: Fewer packages means fewer vulnerabilities to patch
|
|
- **Non-root by default**: `:nonroot` tag runs as UID 65534
|
|
|
|
## Debugging Distroless Containers
|
|
|
|
Since distroless has no shell, use these techniques for debugging:
|
|
|
|
### Debug Image Variant
|
|
|
|
```dockerfile
|
|
# Use debug variant in non-production environments only
|
|
FROM gcr.io/distroless/base-debian12:debug
|
|
# Includes busybox shell at /busybox/sh
|
|
```
|
|
|
|
```bash
|
|
# Exec into debug variant
|
|
kubectl exec -it pod-name -- /busybox/sh
|
|
```
|
|
|
|
### Ephemeral Debug Containers (Kubernetes 1.25+)
|
|
|
|
```bash
|
|
# Attach a debug container with full tooling
|
|
kubectl debug -it pod-name --image=busybox:1.36 --target=app-container
|
|
```
|
|
|
|
### Crane/Dive for Image Inspection
|
|
|
|
```bash
|
|
# Inspect image layers without running
|
|
crane export gcr.io/distroless/static-debian12 - | tar -tf - | head -50
|
|
|
|
# Analyze image layers
|
|
dive gcr.io/distroless/static-debian12
|
|
```
|
|
|
|
## Image Scanning Results
|
|
|
|
Typical vulnerability comparison using Trivy:
|
|
|
|
```bash
|
|
# Scan Ubuntu-based image
|
|
trivy image myapp:ubuntu
|
|
# Result: 47 vulnerabilities (3 CRITICAL, 12 HIGH)
|
|
|
|
# Scan Distroless-based image
|
|
trivy image myapp:distroless
|
|
# Result: 2 vulnerabilities (0 CRITICAL, 0 HIGH)
|
|
```
|
|
|
|
## References
|
|
|
|
- [GoogleContainerTools/distroless GitHub](https://github.com/GoogleContainerTools/distroless)
|
|
- [Distroless Images - Docker Documentation](https://docs.docker.com/dhi/core-concepts/distroless/)
|
|
- [Alpine, Distroless, or Scratch? - Google Cloud](https://medium.com/google-cloud/alpine-distroless-or-scratch-caac35250e0b)
|
|
- [Docker Hardened Images](https://www.infoq.com/news/2025/12/docker-hardened-images/)
|