Distroless

Distroless container images contain only the application and its runtime dependencies — no package manager, shell, or OS utilities. Pioneered by Google, they reduce image size and dramatically shrink the attack surface by removing tools that attackers could use to escalate privileges or move laterally.

Distroless images are commonly used in multi-stage Docker builds.