Free tools Windows power users keep installed
One-click scans. No signup required.
To build a distroless Docker image with BuildKit, use a multi-stage Dockerfile: compile and test in a full builder stage, then copy only the executable and required runtime files into a distroless stage. Build it with docker buildx build, choose a runtime family that matches your binary, run as nonroot where possible, and publish provenance and SBOM attestations with the image.
Antihost offers VPS plans with one-click Docker, NVMe storage and a 14-day free trial.
This approach answers the practical questions behind the pattern: how to make a multi-stage build smaller and safer, how to create multi-platform images with buildx, and how to debug a container that has no shell. The result is not automatically secure or portable; compatibility, certificates, dynamic libraries, file permissions, and diagnostic procedures must be designed explicitly.
As an Amazon Associate I earn from qualifying purchases.
What a distroless BuildKit image is
A distroless image contains an application and the minimum runtime files it needs, rather than a general-purpose Linux userland. It normally has no interactive shell, package manager, compiler, or common command-line utilities. The production container therefore has fewer tools available to an attacker and fewer packages to update, while also losing the conveniences developers expect from a conventional distribution image.
BuildKit is the builder backend used by modern Docker builds. Its solver can execute independent graph steps concurrently, skip stages that are not needed for a selected target, transfer only changed context data, and reuse cache records more precisely than the legacy builder. Distroless is the runtime design; BuildKit is the build engine that makes a repeatable multi-stage workflow efficient.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
GoogleContainerTools’ distroless guidance describes Docker multi-stage builds as the straightforward way to build application artifacts first and insert them into a distroless runtime image. The final image should contain the artifact, configuration, certificates, time-zone data, native libraries, and data files the program actually needs—nothing assumed, and nothing added merely to obtain a shell.
Choose the runtime family before writing the Dockerfile
The final stage must match how the application was compiled and what it loads at runtime. “Distroless” is a family of images, not one universal base. Select the narrowest compatible option and confirm the current tag and Debian release before pinning it in production.
| Distroless family | Use it when | Important checks |
|---|---|---|
static |
The program is genuinely statically linked and does not require a system dynamic loader or shared libraries. | Verify the binary’s linkage. A build that merely appears self-contained may still expect CA certificates, time-zone files, or other data. |
base |
The application needs a compatible Debian userland, dynamic loader, or shared libraries but not additional language runtime components. | Confirm every required shared object and its architecture is present in the selected tag. |
cc |
A C or C++ program needs the runtime libraries supplied by the compatible image. | Check the compiler’s ABI expectations and test each target architecture. |
| Language-specific image | The application needs a language runtime in the final container rather than only a compiled binary. | Match the runtime version and copy application files, modules, certificates, and configuration deliberately. |
:nonroot variant |
The service can run without root privileges. | Check ownership, bind mounts, ports, temporary directories, and every path that must be writable. |
:debug variant |
You need a shell and basic diagnostic tools during investigation. | Use it as a separate diagnostic target or temporary replacement, not as a reason to enlarge production images. |
A static image is not interchangeable with a scratch-like image. TLS clients may need a CA bundle; applications that format local time may need zoneinfo; dynamically linked programs need the loader and libraries; and programs that load templates, migrations, fonts, or certificates need those files copied as well. Treat each dependency as an explicit design decision.
A minimal multi-stage Dockerfile
The following pattern builds a Go application in a full toolchain image and copies one executable into a non-root distroless image. It is an example to adapt, not a universal recipe.
# syntax=docker/dockerfile:1
FROM golang:1.24 AS build
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -o /out/app ./cmd/app
FROM gcr.io/distroless/static-debian13:nonroot
COPY --from=build /out/app /app
USER nonroot:nonroot
ENTRYPOINT ["/app"]Why each instruction matters
# syntax=docker/dockerfile:1selects the current Dockerfile frontend understood by BuildKit.- The builder stage contains the compiler and dependency tooling, but those layers are not copied into the final stage.
- Copying
go.modandgo.sumbefore the rest of the source gives dependency downloads a stable cache key when application files change. CGO_ENABLED=0is appropriate only when the program and its dependencies can be built without C libraries. If cgo is required, use a compatible runtime family and verify the dynamic dependencies instead of forcing a static claim.-trimpathremoves local source paths from the binary, which helps reproducibility and avoids leaking build-directory details.- The final stage copies only
/out/app. Add certificates, zoneinfo, configuration, templates, or other data only when the application needs them. USER nonroot:nonrootmakes the intended identity explicit even though the selected tag already represents a non-root variant.- Exec-form
ENTRYPOINTstarts the process directly, allowing it to receive container signals without a shell intermediary.
Build it with Docker BuildKit and buildx
docker buildx build invokes BuildKit through a buildx builder. A production build commonly looks like this:
docker buildx build
--platform linux/amd64,linux/arm64
--tag registry.example.com/acme/app:1.0.0
--cache-from type=registry,ref=registry.example.com/acme/app:buildcache
--cache-to type=registry,ref=registry.example.com/acme/app:buildcache,mode=max
--provenance=mode=max
--sbom=true
--push .What the important flags do
| Flag | Purpose | Operational consequence |
|---|---|---|
--platform linux/amd64,linux/arm64 |
Builds a multi-platform result for both listed architectures. | The registry receives a manifest list. Test each platform, not just the machine that performed the build. |
--tag |
Assigns the image reference. | Use an immutable release tag or digest in deployment systems; a moving tag is not a reproducibility guarantee. |
--cache-from |
Reads cache records from a registry reference. | CI jobs can reuse work performed by earlier jobs or builders. |
--cache-to ...,mode=max |
Exports detailed cache records. | More intermediate results are available to later builds, at the cost of registry storage. |
--push |
Writes the multi-platform result directly to the registry. | There may be no single local image to run; pull the published reference for testing. |
--provenance=mode=max |
Requests detailed provenance metadata. | Inspectors can see how the build result was produced, subject to the builder and registry’s support. |
--sbom=true |
Requests an SBOM attestation. | The generated metadata can be inspected alongside the image rather than kept as an undocumented file. |
--target name |
Stops at a named Dockerfile stage. | Use this for a test or debug stage without changing the production stage. |
For local iteration, omit --push and choose an output supported by the selected builder. A local image output is convenient for a single platform; a multi-platform result generally belongs in a registry or another explicitly configured output. If a stage is not reachable from the selected target, BuildKit can skip it, reducing work during focused builds.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Designing stages for speed and repeatability
Keep dependency layers stable
Copy lockfiles or module manifests before frequently changing source files. Install dependencies in a separate layer, then copy source and compile. Avoid putting timestamps, random values, or the whole working directory into early layers. A broad build context also invalidates cache unnecessarily, so use a .dockerignore file to exclude version-control metadata, local build output, test artifacts, and secrets.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Do not copy the builder filesystem
Use explicit COPY --from=build statements. Copying an entire directory from the builder can silently include compilers, package caches, credentials, test fixtures, or development configuration. For each copied path, identify why the running process needs it.
Separate test, debug, and release targets
A useful Dockerfile can contain a builder, a test stage, a debug stage, and a production stage. BuildKit will build only the selected graph. For example, a test stage can run unit tests while retaining the full toolchain, and a debug stage can use the matching distroless :debug variant. The release target should remain tool-free.
FROM build AS test
RUN go test ./...
FROM gcr.io/distroless/static-debian13:debug AS debug
COPY --from=build /out/app /app
ENTRYPOINT ["/app"]
FROM gcr.io/distroless/static-debian13:nonroot AS release
COPY --from=build /out/app /app
USER nonroot:nonroot
ENTRYPOINT ["/app"]Run the test target with docker buildx build --target test --progress=plain .. Build the debug target only for an approved diagnostic workflow, and publish it separately if your process requires a registry copy. Do not point production deployments at the debug tag.
How to create multi-platform images with buildx
- Choose the platforms. List the operating-system and architecture pairs your users actually run, such as
linux/amd64andlinux/arm64. Every native dependency, base-image tag, and application artifact must exist for each pair. - Use a builder that supports the requested output. Inspect the available builders with
docker buildx lsand select or create one appropriate for multi-platform builds. The exact emulation or native-worker setup depends on your environment. - Make compilation target-aware. Go, Rust, and similar toolchains can cross-compile, but cgo and other native extensions may require a platform-specific compiler or worker. Do not assume that a successful amd64 build proves arm64 compatibility.
- Build and publish the manifest. Add the platform list and
--pushto the command. A registry then serves the correct image for each client platform. - Pull and run every platform. Verify startup, health checks, TLS, file paths, signal handling, and performance-sensitive native components on actual or emulated targets. A manifest can be syntactically valid while one image fails at runtime.
When a dynamically linked binary fails on only one architecture, inspect its loader and shared-library requirements for that architecture. The final distroless tag must provide compatible libraries; copying libraries from a different architecture or Debian release is not a safe fix.
SBOM and provenance attestations
BuildKit can attach supply-chain metadata to the build result. Its SBOM support generates an SPDX JSON document wrapped in an in-toto attestation. Docker documents SBOM and provenance as metadata attached to build results, so consumers can inspect them through registry-aware tooling rather than relying on a separately uploaded file.
By default, BuildKit scans the final build result for the SBOM. That scope excludes files that exist only in the build context or intermediate stages. If those need coverage, set the documented build arguments:
--build-arg BUILDKIT_SBOM_SCAN_CONTEXT=true
--build-arg BUILDKIT_SBOM_SCAN_STAGE=trueUse context scanning when source or vendored material in the build context must be inventoried. Use stage scanning when intermediate images contain packages or tools that your compliance process tracks. Decide whether those records should be retained and who can read them; an SBOM is useful only when it is associated with the exact image digest and release.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Rootless BuildKit in CI
A Docker daemon is not required for every BuildKit deployment. Standalone BuildKit can run rootlessly, and GitLab documents a rootless multi-platform pattern using moby/buildkit:rootless, buildctl-daemonless.sh, and registry output. This is useful when a CI runner must not expose a privileged Docker socket.
buildctl-daemonless.sh build
--frontend dockerfile.v0
--local context=.
--local dockerfile=.
--opt platform=linux/amd64,linux/arm64
--output type=image,name=registry.example.com/acme/app:1.0.0,push=trueAdapt the runner’s authentication, cache exporter, provenance, and SBOM settings to its policy. Rootless operation changes the permissions and storage constraints of the builder; it does not make an application that requires root magically compatible with a non-root runtime.
How to debug a distroless container with no shell
A missing shell is intentional. Commands such as docker exec -it container sh fail because the executable is not in the image. Do not “fix” production by installing a shell and package manager; that changes the attack surface and creates another image to patch.
Use a matching debug image
Distroless publishes :debug variants. The official README documents launching one with --entrypoint=sh. Use the same application artifact, architecture, and runtime family as production so that observations remain meaningful.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
docker run --rm -it
--entrypoint=sh
gcr.io/distroless/static-debian13:debugFor an application-specific workflow, define a debug target in the Dockerfile and build it with docker buildx build --target debug. Keep credentials and production data out of the diagnostic container, and destroy the temporary image when the investigation ends.
Diagnose without changing the image
- Read container logs and inspect the orchestrator’s exit code, restart count, and health-check output.
- Override the entrypoint only when the image contains a known diagnostic executable; a shell cannot be summoned if none exists.
- Use a temporary sidecar or ephemeral debugging container with the required tools, subject to your orchestrator’s security policy.
- Inspect the image manifest, config, labels, and attestations with registry-aware tooling.
- Reproduce the failure in the builder or test stage, where compilers, package managers, and tracing tools are available.
Document the approved path before production incidents occur. Teams lose time when the only documented procedure is an interactive shell that the release image deliberately does not contain.
Runtime files that commonly break after distroless conversion
CA certificates
HTTPS clients may fail certificate verification if the final image does not contain a trusted CA bundle. Select a runtime image that supplies the needed certificates or copy a reviewed bundle into the final stage. Do not disable certificate verification as a workaround.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Time-zone data
Applications that convert timestamps using named zones may require zoneinfo files. A UTC-only service may not, but confirm the application’s behavior and tests rather than assuming the base image includes the database.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Dynamic libraries and loaders
A binary can be executable yet fail immediately because its ELF interpreter or shared objects are absent. Build with a truly static configuration when that is supported and tested; otherwise choose base, cc, or the relevant language image and verify the complete dependency set.
Writable directories and ownership
Non-root execution exposes assumptions about writing to the working directory, temporary files, sockets, caches, and mounted volumes. Create only the directories needed, assign ownership deliberately, and configure a writable mount where state is unavoidable. Never restore root solely to hide a permission error.
Configuration and data files
Templates, migrations, static assets, fonts, trust stores, and license files are easy to omit when copying only one executable. Make their paths explicit in the Dockerfile and test from the same working directory and environment used in deployment.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Security and operational verification checklist
- Confirm that the final stage contains only the executable, required libraries, certificates, configuration, and data files.
- Run as the non-root user whenever the application supports it; verify ownership and writable-directory requirements.
- Check that secrets are not copied into the build context or persisted in image layers. Use the build system’s secret mechanisms instead of ordinary
ARGorENVfor sensitive values. - Test every platform in the manifest, especially when dynamic linking, native extensions, or architecture-specific data are involved.
- Exercise health checks, shutdown, restart, and graceful signal handling. There is no shell fallback to interpret signals or run a stop hook.
- Keep a separate debug target and record who may use it, how it is authenticated, and when it must be removed.
- Inspect the pushed manifest, image digest, provenance, and SBOM attestations with tooling that understands your registry.
- Pin and review base-image tags and rebuild when their security updates are required. Confirm the Debian release and runtime tag before production pinning.
Trade-offs: when this design fits
| Decision axis | Distroless plus BuildKit provides | Cost or limitation |
|---|---|---|
| Runtime compatibility | A deliberately selected runtime with only the files the application needs. | Missing certificates, loaders, libraries, or data fail at startup unless explicitly supplied. |
| Attack surface and identity | Fewer packages and no general-purpose shell; non-root variants make least privilege easier. | Security still depends on application code, configuration, kernel isolation, permissions, and timely base-image updates. |
| Debuggability | Dedicated debug variants and test stages preserve diagnostic capability outside production. | Interactive diagnosis is less convenient and requires a documented alternate path. |
| Reproducibility and evidence | Multi-stage boundaries, cache records, provenance, and SBOM attestations make the build process inspectable. | Attestations require registry and policy support, and broader SBOM scanning must be enabled deliberately. |
| Build and delivery performance | Concurrent graph execution, skipped stages, incremental context transfer, and reusable remote cache can reduce repeated work. | Multi-platform compilation, cache storage, emulation, and registry transfers add setup and operational complexity. |
There is no honest universal image-size, build-time, or vulnerability-count promise. The result depends on the language, dependencies, selected Debian release, platforms, cache state, and application assets. Measure those properties for your own image and record the conditions alongside the result.
Recommended Free Tools
Troubleshooting common failures
“The container exits immediately”
Check the image’s entrypoint, executable path, architecture, exit code, and logs. A missing dynamic loader, shared library, certificate, configuration file, or required data directory is more likely than a missing shell. Rebuild a debug target or run the same artifact in the builder stage to obtain diagnostic tools.
“Exec format error” on one platform
The image may contain a binary for the wrong architecture, or a build step may have produced only the host architecture. Confirm the manifest’s platform entries and compile the artifact for each requested target. Test the failing platform directly rather than trusting a successful amd64 run.
“Permission denied” as nonroot
Find the exact path the process opens or creates, then change ownership during the image build or mount a writable volume there. Check port selection as well: binding a privileged port may require a design change rather than root.
“TLS or time-zone behavior changed”
Compare the final image’s CA and zoneinfo files with the builder or previous runtime. Add the required files or select a compatible runtime family, then test certificate validation and named-zone conversions in the target platform.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall“The cache is ignored in CI”
Verify that the job can read the reference passed to --cache-from, that the exporter used mode=max when detailed records are expected, and that Dockerfile ordering gives dependencies stable keys. A changed build argument, base tag, lockfile, or build context can legitimately invalidate cache entries.
“SBOM does not list build dependencies”
The default scan covers the final result. Enable BUILDKIT_SBOM_SCAN_CONTEXT=true and/or BUILDKIT_SBOM_SCAN_STAGE=true for context and intermediate-stage coverage, then verify that the registry retained the resulting attestation.
“I cannot open a shell in production”
That is expected for a distroless image. Use the matching debug variant, a dedicated debug target, a temporary diagnostic container, or logs and tracing from the surrounding platform. Adding a package manager to production trades away the property you selected distroless to obtain.
A practical release sequence
- Build the application and run unit tests in the full builder stage.
- Inspect linkage and enumerate runtime files: executable, libraries, certificates, zoneinfo, configuration, and data.
- Create a minimal release stage with an appropriate distroless family and non-root identity.
- Build a single platform locally and exercise startup, health, shutdown, TLS, time zones, and writable paths.
- Build the test or debug target separately; verify that the documented incident procedure works.
- Build all release platforms with
docker buildx build, using registry cache and an immutable release tag. - Push the manifest and attestations, then inspect the digest, provenance, and SBOM.
- Deploy the exact digest, monitor health and graceful termination, and retain the corresponding build metadata.
The Bottom Line
Use multi-stage Dockerfiles to keep compilers and shells out of production, select a distroless runtime that matches the binary, and let BuildKit handle multi-platform output, cache reuse, and attestations. Keep debugging in a separate target, test every platform, and treat certificates, dynamic libraries, permissions, and SBOM scope as explicit release requirements.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
