Look into using distroless runtime images

[jonjohnsonjr]

We currently use random images from dockerhub as the runtime images instead of gcr.io/distroless.

This has some performance benefits due to locality of images when running any of this on GCP.

[simonz130]

Who is maintaining these images?
Is there a delta between what's found at gcr.io/distroless and docker registry?

[jonjohnsonjr]

Who is maintaining these images?

We are! (well... our organizational cousins are): https://github.com/GoogleContainerTools/distroless

Is there a delta between what's found at gcr.io/distroless and docker registry?

Yeah, distroless doesn't contain a shell or any random binaries. This results in smaller images and a smaller attack surface for vulnerabilities.

[balopat]

+1 on this for minimal images - I just tried the python guestbook app from Hungary, the image is 1.1GB and that takes 3.7minutes just to push to eu.gcr.io.