Q: Why and how do you enforce minimal or distroless container images (e.g., Chainguard, Wolfi, GoogleContainerTools/distroless) across developer workloads, and how do you resolve developer debugging friction when shells and package managers are absent?

Maintain an enterprise container registry mirror populated with vetted, daily-scanned distroless base images (Java, Node.js, Python, Go, Rust) sourced from Chainguard/Wolfi or Google Distroless, pre-configured with non-root UID/GID security contexts.

# Multi-stage build using Wolfi base
FROM golang:1.24-alpine AS builder
WORKDIR /app
COPY . .
RUN CGO_ENABLED=0 go build -o server .

FROM cgr.dev/chainguard/static:latest
COPY --from=builder /app/server /server
USER 65532:65532
ENTRYPOINT ["/server"]

Train developers and configure tooling to utilize Kubernetes Ephemeral Debug Containers (kubectl debug pod --image=nicolaka/netshoot --target=app-container). This attaches a temporary diagnostic container containing curl, dig, and tcpdump sharing the process and network namespace without compromising the production image.

kubectl debug -it pod/order-service-7bb-x8 --image=nicolaka/netshoot \
  --target=order-service --share-processes

Incorporate container scanners in the CI golden path to verify base image provenance and fail builds on root execution or banned OS packages. Enforce cluster admission via Kyverno/Gatekeeper policies requiring images to come from approved distroless registries and run as non-root.

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-non-root-and-approved-registry
spec:
  validationFailureAction: Enforce
  rules:
  - name: check-run-as-non-root
    match:
      resources:
        kinds: [Pod]
    validate:
      message: 'Running as root is forbidden.'
      pattern:
        spec:
          securityContext:
            runAsNonRoot: true