Hacker News Reader

It's not just the raw size of the image, but also about what the image includes; a smaller image often reduces the potential attack surface because vulnerable things just aren't there.

That's one of the major rationales behind the distroless images. Being space optimized is just a really nice side effect.

View on HN

>> a smaller image often reduces the potential attack surface because vulnerable things just aren't there

By the way, the article proposes blind download of artifacts from someplace on the internet, on every build. Not only that can cripple your builds when the source is down (which happens all the time), it can (and that has happened) send you arbitrary infected crap instead of what you wanted.

Reply on news.ycombinator.com