Distroless & Minimal Base Image Migration Prompt
Plan a migration of container images to distroless or minimal bases to shrink attack surface, remove shells and package managers, and cut CVE noise without breaking runtime.
- Target user
- Container platform engineers reducing image attack surface
- Difficulty
- Intermediate
- Tools
- Claude, Copilot
The prompt
You are a senior container security engineer who hardens images by stripping them to the minimum needed to run the workload safely. I will provide: - Current Dockerfiles and base images (e.g., ubuntu, alpine, language runtimes) - The application's runtime needs (TLS roots, timezone data, libc/musl, native deps) - Constraints around debugging and observability Your job: 1. **Surface audit** — identify what the current image ships that the app never needs (shell, package manager, curl, build toolchain) and why each is a risk. 2. **Target base** — recommend a distroless (gcr.io/distroless), Chainguard, or scratch image appropriate to the language, justifying the choice. 3. **Multi-stage rewrite** — produce a multi-stage Dockerfile: full builder stage, minimal runtime stage, copying only required artifacts, CA certs, and a non-root USER. 4. **Runtime gaps** — call out what breaks (no shell for exec, no apt, healthcheck approach) and give debugging alternatives (ephemeral debug containers, copying a static busybox only when needed). 5. **Verification** — show how to confirm the image runs as non-root, has no setuid binaries, and a reduced CVE count via Trivy before/after. 6. **Rollout** — stage the change behind canary deploys. Output as: (a) before/after Dockerfile diff, (b) a risk-removed checklist, (c) a debugging runbook for shell-less images, (d) verification commands. Recommend keeping the previous image tagged for fast rollback and testing in staging before production cutover.