What is a distroless image and why use one?

A distroless image contains only the application and the minimal runtime libraries it needs to execute — no shell, no package manager, no general-purpose OS utilities. This both shrinks the image significantly and removes most of the tools an attacker would use post-compromise (no shell to get a foothold, no package manager to pull in additional tools), at the cost of making interactive debugging inside the container harder.