Distroless images concept in Docker - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Why use Distroless images in Docker?

Which of the following is the main advantage of using Distroless images for Docker containers?

A They include a full operating system for easier debugging inside the container

B They automatically update the container with the latest OS patches

C They reduce image size and attack surface by excluding package managers and shells

D They allow running containers without specifying a base image

💡 Hint

Think about what is removed from Distroless images compared to traditional base images.

Distroless images remove unnecessary OS components like shells and package managers, making the image smaller and more secure by reducing the attack surface.

💻 Command Output

intermediate

Output of running a Distroless image without shell

What will happen if you try to run docker run -it distroless/base and then try to execute bash inside the container?

A You get an error: 'bash: command not found'

B The container exits immediately because no shell is available

C The container restarts automatically

D You get a shell prompt and can run bash commands

💡 Hint

Distroless images do not include shells like bash.

Distroless images exclude shells, so trying to run bash inside will result in 'command not found' error.

❓ Configuration

advanced

Dockerfile using Distroless image for a Go app

Which Dockerfile snippet correctly builds a Go application and uses a Distroless image for the final container?

A

FROM golang:1.20 AS builder
WORKDIR /app
COPY . .
RUN go build -o myapp
FROM gcr.io/distroless/base
COPY --from=builder /app/myapp /
CMD ["/myapp"]

B

FROM golang:1.20
WORKDIR /app
COPY . .
RUN go build -o myapp
FROM ubuntu
COPY --from=builder /app/myapp /
CMD ["/myapp"]

C

FROM alpine
WORKDIR /app
COPY . .
RUN go build -o myapp
CMD ["/myapp"]

D

FROM gcr.io/distroless/base
WORKDIR /app
COPY . .
RUN go build -o myapp
CMD ["/myapp"]

💡 Hint

Look for a multi-stage build that compiles the app first, then copies the binary into a Distroless image.

Option A uses a multi-stage build: first it builds the Go app in a golang image, then copies the binary into a Distroless base image for a minimal final container.

❓ Troubleshoot

advanced

Why does a Distroless container fail to start with 'no such file or directory'?

You built a container using a Distroless image but it fails to start with the error: no such file or directory. What is the most likely cause?

A The container lacks a shell to run the binary

B The binary is missing executable permissions

C The Dockerfile is missing the CMD instruction

D The binary depends on shared libraries not included in the Distroless image

💡 Hint

Distroless images include only minimal runtime dependencies.

If the binary depends on shared libraries not present in the Distroless image, it will fail to start with 'no such file or directory' because the loader cannot find required libraries.

✅ Best Practice

expert

Best practice for debugging Distroless containers

Since Distroless containers lack shells and debugging tools, what is the best practice to debug issues inside such containers?

A Add a shell and debugging tools to the Distroless image

B Use multi-stage builds to create a debug image with tools and run it instead

C Run the container with <code>docker exec -it</code> to get shell access

D Restart the container with verbose logging enabled

💡 Hint

Think about how to keep the final image minimal but still debug when needed.

Best practice is to use multi-stage builds to create a separate debug image that includes shells and tools, so you can debug without bloating the production image.