Repository navigation
Distroless images #1261
Description
Ship Cozystack-built images on minimal/distroless bases to cut runtime footprint and attack surface.
Current state (as of 2026-06)
Audit of cozystack-BUILT images (those with a Dockerfile/build target under packages/*/images/*; vendored upstream charts excluded). "Distroless?" is judged on the final stage only.
| Image / component | Dockerfile path | Final base | Distroless? |
|---|---|---|---|
| backup-controller | packages/system/backup-controller/images/backup-controller/Dockerfile | scratch | yes |
| backupstrategy-controller | packages/system/backupstrategy-controller/images/backupstrategy-controller/Dockerfile | scratch | yes |
| cozystack-api | packages/system/cozystack-api/images/cozystack-api/Dockerfile | scratch | yes |
| cozystack-controller | packages/system/cozystack-controller/images/cozystack-controller/Dockerfile | scratch | yes |
| token-proxy | packages/system/dashboard/images/token-proxy/Dockerfile | scratch | yes |
| flux-plunger | packages/system/flux-plunger/images/flux-plunger/Dockerfile | scratch | yes |
| kubeovn-plunger | packages/system/kubeovn-plunger/images/kubeovn-plunger/Dockerfile | scratch | yes |
| lineage-controller-webhook | packages/system/lineage-controller-webhook/images/lineage-controller-webhook/Dockerfile | scratch | yes |
| kubevirt-cloud-provider | packages/apps/kubernetes/images/kubevirt-cloud-provider/Dockerfile | scratch | yes |
| ubuntu-container-disk | packages/apps/kubernetes/images/ubuntu-container-disk/Dockerfile | scratch | yes |
| kamaji | packages/system/kamaji/images/kamaji/Dockerfile | gcr.io/distroless/static:nonroot | yes |
| keycloak-operator | packages/system/keycloak-operator/images/keycloak-operator/Dockerfile | gcr.io/distroless/static:nonroot | yes |
| objectstorage (controller+sidecar) | packages/system/objectstorage-controller/images/objectstorage/Dockerfile | gcr.io/distroless/static:nonroot | yes |
| cluster-autoscaler | packages/apps/kubernetes/images/cluster-autoscaler/Dockerfile | gcr.io/distroless/static:nonroot | yes |
| cozystack-operator | packages/core/installer/images/cozystack-operator/Dockerfile | alpine:3.22 | no |
| migrations | packages/core/platform/images/migrations/Dockerfile | alpine:3.22 | no |
| grafana-dashboards | packages/system/grafana-operator/images/grafana-dashboards/Dockerfile | alpine:3.22 | no |
| mariadb-backup | packages/apps/mariadb/images/mariadb-backup/Dockerfile | alpine:3.20 | no |
| s3manager | packages/system/bucket/images/s3manager/Dockerfile | alpine:latest | no |
| redis-operator | packages/system/redis-operator/images/redis-operator/Dockerfile | alpine:latest | no |
| kubeovn-webhook | packages/system/kubeovn-webhook/images/kubeovn-webhook/Dockerfile | alpine:3.21.3 | no |
| kilo | packages/system/kilo/images/kilo/Dockerfile | alpine:3.23 | no |
| clickhouse-backup | packages/apps/clickhouse/images/clickhouse-backup/Dockerfile | clickhouse-server:alpine + restic | no |
| linstor-gui | packages/system/linstor-gui/images/linstor-gui/Dockerfile | nginx-unprivileged:alpine | no |
| linstor-csi | packages/system/linstor/images/linstor-csi/Dockerfile | debian:trixie-slim | no |
| piraeus-server | packages/system/linstor/images/piraeus-server/Dockerfile | debian:bookworm | no |
| multus-cni | packages/system/multus/images/multus-cni/Dockerfile | debian:stable-slim | no |
| kubevirt-csi-driver | packages/apps/kubernetes/images/kubevirt-csi-driver/Dockerfile | centos:stream9 + mount tooling | no |
| nginx-cache | packages/apps/http-cache/images/nginx-cache/Dockerfile | ubuntu:22.04 | no |
| e2e-sandbox (test only) | packages/core/testing/images/e2e-sandbox/Dockerfile | ubuntu:22.04 | no |
| grafana | packages/system/monitoring/images/grafana/Dockerfile | grafana/grafana (upstream) + plugins | no (upstream) |
| cilium | packages/system/cilium/images/cilium/Dockerfile | quay.io/cilium/cilium (re-tag) | upstream re-tag |
| metallb (controller+speaker) | packages/system/metallb/images/metallb/Dockerfile | quay.io/metallb/* (re-tag) | upstream re-tag |
| altinity-clickhouse-backup | packages/apps/clickhouse/images/altinity-clickhouse-backup/Dockerfile | altinity/clickhouse-backup (re-tag) | upstream re-tag |
| matchbox | packages/core/talos/images/matchbox/Dockerfile | quay.io/poseidon/matchbox (re-tag) + assets | upstream re-tag |
| cozystack-ui (console) | built via packages/system/dashboard/Makefile (clones cozystack-ui repo) | base in external repo | unknown (external) |
Summary
- Of the images cozystack controls the final stage for (excluding 4 upstream re-tags + the external
cozystack-uibuild): 14 already distroless/static, 15 not. - Already distroless: 10 Go services on
scratch(controllers/webhooks/API) + 4 ongcr.io/distroless/static:nonroot(kamaji, keycloak-operator, objectstorage, cluster-autoscaler). Every pure-Go binary we author already ships distroless. - Low-effort wins — CGO-off Go binaries on alpine that can likely move to
distroless/static(CA certs + tzdata included): cozystack-operator, redis-operator, kubeovn-webhook, s3manager. - Web/static servers — candidate but entrypoint-dependent: linstor-gui (already gets nginx.conf via ConfigMap), nginx-cache.
- Hard blockers (need shell / package manager / glibc / mount userland — at best
distroless/base, notstatic): migrations, grafana-dashboards, mariadb-backup, clickhouse-backup (shell + restic/apk); kilo, multus-cni (CNI install scripts need a shell); linstor-csi, piraeus-server (DRBD/LINSTOR native glibc); kubevirt-csi-driver (e2fsprogs/xfsprogs/nfs-utils mount userland). e2e-sandbox is test-only, out of scope. - Out of cozystack's hands — upstream re-tags: cilium, metallb, altinity-clickhouse-backup, matchbox, grafana. Distroless status is an upstream decision.
Activity
docs(roadmap): reconcile timelines and remap dissolved CNCF venues