Lion Cipher Lab
Cut a container's attack surface with a distroless image — and measure what you removed
- Cloud Security
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Every package inside your container image is code an attacker inherits the moment they land — a CVE to exploit, or a tool like a shell, curl, or a package manager to pull the next stage of an attack. Most images ship a full mini-Linux the app never uses. This lab has you build the exact same service twice and put the numbers side by side: a full base with dozens of OS-package CVEs and an interactive shell, versus a distroless image with almost no OS packages, near-zero OS CVEs, and no shell at all. Once you have measured the difference yourself, 'shrink the base' stops being advice you nod at…
What you'll learn
- Base-image minimization
- Multi-stage Docker builds
- Distroless images
- Measuring attack surface with Trivy
- Reading CVE counts by severity
- Container security judgment (when distroless fits, when it doesn't)
Steps in this lab
- What this lab is — and what it is NOT
- Set up: a folder and a 15-line app
- BEFORE — build on a full base image
- Measure the BEFORE image — size, CVEs, and prove a shell exists
- AFTER — a multi-stage build onto distroless
- Measure the AFTER image — and prove the shell is GONE
- The honest limits — what distroless does NOT fix