Harden Docker Container Images

To ease the process of hardening docker images, Istio provides a set of images based on distroless images

Install distroless images

Follow the Installation Steps to setup Istio. Add the option --set tag=1.9.1-distroless to use the distroless images.

  1. $ istioctl install --set tag=1.9.1-distroless

Benefits

Non-essential executables and libraries are no longer part of the images when using the distroless variant.

  • The attack surface is reduced. Include the smallest possible set of vulnerabilities.
  • The images are smaller, which allows faster start-up.

See also the Why should I use distroless images? section in the official distroless README.

Be aware that common debugging tools such as bash, curl, netcat, tcpdump, etc. are not available on distroless images.