Stripping the Attack Surface: Deterministic Multi-Stage Builds with Distroless Runtimes

Eliminating shell binaries, package managers, and CVE noise from production containers.

Jan 28·5 min read·Automation

Stripping the Attack Surface: Deterministic Multi-Stage Builds with Distroless Runtimes

“If an attacker lands in a container with no bash, no curl, and no package manager, their exploit dies in memory.”

Containers should contain applications, not operating systems. By adopting Google's Distroless base images and multi-stage build artifacts, our security scanning alerts dropped from 140 vulnerabilities to zero.

The Problem with Alpine and Debian

Default base images bundle curl, wget, and package managers - tools that developers rarely need in production but attackers rely on for remote shell downloads.

Distroless images include only the application runtime and its dynamic dependencies, making interactive shell escapes physically impossible.

Selected Writing

See all writing →

Deterministic Cloud Invariants: Designing Ephemeral Environments with Zero State Drift

A mathematical framework for cloud isolation and on-demand cluster lifecycles.

Oct 14·6 min read

Terraform

Zero-Downtime Rollouts: Statistical Canary Verification in Multi-Cluster Mesh

Automated traffic weighting and real-time Mann-Whitney U error budget analysis.

Aug 4·5 min read

Kubernetes

Short-Lived Credentials: Eliminating Long-Lived AWS Keys with GitHub OIDC

A practical blueprint for zero static secrets via cryptographic STS role federation.

Jun 18·4 min read

Cloud

Telemetry Without Noise: High-Cardinality Distributed Tracing in Production

Linking anomalous metric spikes directly to contextual exemplar trace graphs.

Apr 22·7 min read

Networking