Container security is moving from vulnerability detection to attack surface reduction

Container security has evolved from a repetitive cycle of scanning, identifying vulnerabilities, and patching to a more strategic approach focused on reducing the attack surface. As vulnerabilities continue to rise and regulatory requirements become more stringent, engineering teams are finding it increasingly challenging to sustain this approach. A study found that 58% of respondents use vulnerability scanning as a software supply chain security control, while 47% consider it a top investment priority.

Sudeep Goswami, CEO of Traefik Labs, discussed an alternative approach to container security in the latest AppDevANGLE podcast episode. Traefik is pursuing this strategy through Distro Zero, an approach that aims to strip away unnecessary operating system components and dependencies from container infrastructure. The idea is to reduce the software loaded into container infrastructure so that fewer vulnerabilities exist in the first place.

Goswami explained that vulnerability scanners are still crucial for software supply chain security, but they do not change the size of the attack surface. Each dependency packaged into a container introduces another component that must be scanned, tracked, patched, and documented. This process can be overwhelming, as 80% of the vulnerabilities encountered by Traefik are often noise rather than relevant threats.

Distro Zero aims to remove this surrounding dependency surface and deliver the application as a self-contained binary. The goal is not to make vulnerability scanning obsolete but to reduce what scanners and security teams must manage. The difference between traditional distroless containers and Distro Zero lies in the latter's comprehensive approach, which removes not only toolkit components like shells and package managers but also other runtime dependencies such as C libraries and cryptographic libraries.

For platform engineering and application security teams, the focus has shifted from minimizing tooling inside an image to understanding the complete runtime dependency chain. This shift reflects the growing emphasis on memory safety, with organizations adopting memory-safe languages where possible to prevent entire classes of vulnerabilities.

Regulatory requirements, such as NIST frameworks and the European Union Cyber Resilience Act, are increasingly intersecting with engineering workflows, necessitating a more holistic approach to compliance.

Goswami highlighted the importance of consolidating regulatory requirements within a single framework, such as Distro Zero, which offers FIPS 140-3 compliance and addresses other regulatory guidelines like the EU CRA. This consolidation can help reduce operational complexity by minimizing the need for separate infrastructure and processes for various security and compliance requirements.

By consolidating these requirements into a single framework, enterprises can better manage their attack surface, vulnerability management, and overall security posture.