zachbg/distroless-python
Minimal Python 3.12 on distroless - 50MB production-ready container
Image
1
1.8K
zachbg/distroless-python repository overview
distroless-python
Minimal, secure Python runtime — no shell, no package manager, no attack surface.
Why?
Standard Python images ship with bash, apt, curl, and hundreds of binaries attackers love. This image strips everything down to:
- Python interpreter — and nothing else
- Your app code — copied from builder stage
- pip packages — only what you need
- Non-root user —
uid 65534by default - No shell — can't
execinto the container
Size Comparison
| Image | Size |
|---|---|
python:3.12 | ~1 GB |
python:3.12-slim | ~150 MB |
zachbg/distroless-python | ~50 MB |
Quick Start
1. Create your app
myapp/
├── main.py
├── requirements.txt
└── Dockerfile
2. Use this as your base
FROM python:3.12-slim AS builder
WORKDIR /build
COPY requirements.txt .
RUN pip install --no-cache-dir --prefix=/install -r requirements.txt
COPY . /build/app
FROM zachbg/distroless-python:3.12
COPY --from=builder /install/lib/ /usr/local/lib/
COPY --from=builder /build/app /app
WORKDIR /app
USER nonroot
ENTRYPOINT ["python3"]
CMD ["main.py"]
3. Build and run
docker build -t myapp .
docker run myapp
FastAPI Example
FROM python:3.12-slim AS builder
WORKDIR /build
RUN pip install --no-cache-dir --prefix=/install fastapi uvicorn
COPY . /build/app
FROM zachbg/distroless-python:3.12
COPY --from=builder /install/lib/ /usr/local/lib/
COPY --from=builder /build/app /app
WORKDIR /app
USER nonroot
EXPOSE 8000
ENTRYPOINT ["python3", "-m", "uvicorn", "main:app", "--host", "0.0.0.0"]
Debugging
Can't shell in? Use the debug variant:
docker run -it zachbg/distroless-python:3.12-debug sh
Build from Dockerfile.debug for a version with busybox.
Tags
| Tag | Description |
|---|---|
3.12 | Python 3.12, distroless, non-root |
3.12-debug | Same + busybox shell |
3.11 | Python 3.11 variant |
latest | Latest stable Python |
Security
- 0 CVEs in base image (vs. 50+ in
python:slim) - No shell — RCE doesn't give interactive access
- Non-root — filesystem is read-only to app
- Minimal packages — tiny attack surface
Multi-arch
docker buildx build --platform linux/amd64,linux/arm64 -t zachbg/distroless-python --push .
License
MIT
Tag summary
Content type
Image
Digest
sha256:3a3f7aaa7…
Size
18.8 MB
Last updated
6 months ago
docker pull zachbg/distroless-python