{
  "id": 15609052,
  "title": "The distroless security gap: Why bottom-up containers are the next evolution in OCI images",
  "url": "https://urgent.news/2026/10/19/the-distroless-security-gap-why-bottom-up-containers-are-the-next",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-19T13:00:00.000Z",
  "source": {
    "name": "The New Stack",
    "slug": "the-new-stack",
    "url": "https://thenewstack.io/distroless-container-security-gap/"
  },
  "original_language": "en",
  "account": "The expanding attack surface of container images has posed a significant security challenge for organizations. Traditional container images, built with full operating systems, include unnecessary components that can serve as a potential vulnerability and increase the attack surface. This approach, known as \"distroless,\" aims to strip the container down to minimal dependencies needed for the application to run. However, creating a distroless image is complex and prone to errors, resulting in a security gap where package metadata is missing. This leads to false negatives in security scanners, making the container a compliance liability. To address this issue, a third option has emerged: building containers from the bottom up. This approach involves creating a minimal, auditable OCI image by starting from scratch and including only the exact elements needed for the application. The process consists of three stations: slicing, building, and running. During the slicing stage, standard, trusted Linux packages are divided into smaller, granular pieces using tools like Chisel. The metadata for these slices is preserved, ensuring that security scanners remain fully operational. In the building stage, a declarative approach replaces imperative Dockerfiles. Developers write a simple YAML file describing the app and its needs, which the build tool then fetches the required package slices, compiles everything, and outputs a standard, OCI-compliant container image. Finally, in the running stage, the container must manage process management. Inside a container, if the application spawns child processes and they die, they leave behind \"zombies\" - dead processes that still occupy system resources.",
  "summary": "Ever tried to shrink your container images to reduce their attack surface? If you have, you’ve likely discovered a frustrating The post The distroless security gap: Why bottom-up containers are the next evolution in OCI images appeared first on The New Stack .",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}