---
title: What is image distillation?
description: ""
lang: en
date: 2026-06-16T02:59:00.000Z
tags:
  - Developer Experience
  - Containerization
  - Debian
  - Ubuntu
  - Docker
---

June 16, 2026

There are at least four ways to go about building container images:

- Small distributions, like Alpine
- Cut-down server versions (e.g., `debian-slim`)
- Whatever tf Ubuntu Chiseled is
- Distroless

I use a fifth one.

## Pain

In my experience, no one really likes building Alpine images, but because
they're so lean, people feel forced to. MUSL, busybox, ash, python issues,
package names often differ, command flags vary slightly, and so on.

I've used Ubuntu/Debian as an image base since 2018 because my developers were
Debian-oriented and felt much more confident whenever they had to operate inside
containers to debug.

In production, though, Debian-based images are far from perfect. Debian has long
confused 'paleolithic' with 'stability.' Meanwhile, Canonical adds useless
thingamajigs like Pebble—complete with a bunch of Go stdlib vulnerabilities—or
ruins RISC-V compatibility with an unnecessary move to vector extensions.

Distroless images are pure and perfect — and also feel like a war crime when
you're actually building them. Every single dependency has to be hand-crafted,
and you constantly feel phantom pain from missing basic shell tools.

Don't get me wrong: I love it, but it's a kink.

## Distillation

To keep a cozy environment while working on a project, while simultaneously
stripping down the attack surface of the production image, I use a technique I
call **image distillation**.

It's fairly obvious (I'm pretty sure many people do this, I didn't invent
anything), but I haven't found an established term for it yet (I'd be glad to be
proven wrong if you know one).

 1. Build in whatever base image you like: Alpine, Ubuntu, or whatever Red Hat is calling their server distro this week.
 1. At the end of that build stage, `COPY` everything you actually need (binary + libraries + runtime data) into a single folder (mine is usually called `/export`).
 1. Add a final stage with `FROM scratch` or `FROM distroless`, with a single `COPY --from=builder /export /`.

You get the fat-free security of distroless in production with the developer
pleasantries of a full OS during build time.

You won't get any progress in understanding the meaning of life or finding true
love, though.

It's just a slim container image, what did you expect?

## Tags

[Developer Experience](/tag/developer-experience/),
[Containerization](/tag/containerization/), [Debian](/tag/debian/),
[Ubuntu](/tag/ubuntu/), [Docker](/tag/docker/)

## Navigation

[← What is B19?](/post/what-is-b19/) | [AI Stance →](/post/ai-stance/)

## Skills

[Containers & Docker](/skill/containerization/), [Linux](/skill/linux/)