A Smaller Image Is a Smaller Attack Surface
No shell, no package manager, no curl. Most of your CVE count comes from tools your app never uses.
Scan a typical Node image and you get a long list of vulnerabilities. Look at where they come from and most are in packages your application never calls — a shell, a package manager, compilers, curl, half a Linux distribution shipped to production for no reason.
Patching that list is treating a symptom. Not shipping those packages is the fix.
Multi-stage builds
Build with everything, ship with almost nothing:
FROM node:22 AS build
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build
FROM gcr.io/distroless/nodejs22-debian12
WORKDIR /app
COPY --from=build /app/dist ./dist
COPY --from=build /app/node_modules ./node_modules
CMD ["dist/server.js"]The build stage has compilers, dev dependencies and a package manager. None of it reaches the final image. Typical result on my projects: an image several times smaller with a fraction of the findings.
What distroless removes
No shell. No package manager. No curl or wget.
That is inconvenient for debugging and excellent for security. An attacker who achieves code execution in a container with no shell and no way to fetch tooling is substantially constrained.
If your workflow depends on docker exec ... sh, this is a real change in habits. Ephemeral debug containers and proper logging replace it, which is where you wanted to be anyway.
The other easy wins
A .dockerignore. Without one you are copying .git, node_modules, and possibly .env into your build context. That last one has ended up in shipped images more than once.
Production dependencies only in the final stage.
A non-root user. Distroless images provide one; use it.
Pin the base image by digest, not by a floating tag, so your builds are reproducible and cannot silently change.
Order layers by change frequency — dependencies before source — so rebuilds are fast.
The measurable outcome
The last client project I did this on went from an image well over a gigabyte with dozens of high findings to a couple of hundred megabytes with a handful — without changing a line of application code.
Deploys got faster too, which is the argument that tends to persuade people who were unmoved by the security one.
Resources
- Repo: GoogleContainerTools/distroless
- Video walkthroughs: YouTube: distroless multi-stage docker
- Measure it with Trivy
Need this built properly?
I build secure, fast, bilingual platforms for clients across Egypt, Saudi Arabia, the UAE and Kuwait.
