Distroless Docker image, not any more?

Traefik
1

I remember a couple of months ago, the Docker image was distroless, meaning `FROM scratch`. More or less just a `/traefik` binary and that’s it. I remember even an official blog post bragging about it in the name of safety etc.

Today, I noticed now the Docker image is a full-blown Alpine. I suspect it happened via commit 39b0aa6650d94dd4c8320d23fae4e69986930cb9.

Why the change? Is it intentional?

I liked the safety-first approach that was taken. I’m running my image read-only (except `/tmp`) and take away all capabilities from its root user except `NET_BIND_SERVICE`:

read_only: true
cap_drop:
  - ALL
cap_add:
  - NET_BIND_SERVICE
security_opt:
  - "no-new-privileges"
2

Quickly checked Docker hardened image for Traefik, they use Debian.

The mentioned commit as link. But it seems the change happened already 2 years ago (link).

3

Yes, the change was a while ago. But I don’t code review every version.

I was more interested into why traefik stepped back?

4

That's probably a question for the devs. You can try your luck at Traefik Github.