What is the difference between alpine, slim and distroless base images?
alpine is a tiny distro using musl libc and apk. slim variants are trimmed Debian images using glibc. distroless images contain only your app and its runtime, with no shell or package manager, giving the smallest attack surface.
Explain it simply
Choosing luggage for a trip. Full ubuntu is a big trunk with everything. Slim is a cabin bag. Alpine is a small backpack. Distroless is only the clothes you wear, with no bag at all.
Alpine is about 5 MB and uses musl instead of glibc. Most things work, but some prebuilt Python wheels or native Node modules misbehave or compile slowly. Slim (like python:3.12-slim) is Debian with documentation and extras removed, roughly 40-120 MB depending on the language, and is the safe default because it uses glibc. Distroless (Google's images) has no shell, no apt, no curl, so an attacker who gets in has few tools, but you cannot docker exec a shell; use a debug variant for troubleshooting.
Pick slim for convenience, distroless for hardened production, alpine when you know your dependencies work with musl.
Example
FROM python:3.12-slim # glibc, small, easy
# FROM python:3.12-alpine # smaller, musl quirks
# FROM gcr.io/distroless/python3-debian12 # no shell at allWhat to say in the interview
"Alpine is tiny but uses musl, slim is a trimmed glibc Debian, and distroless has just the app runtime with no shell or package manager. I default to slim, use distroless for hardened production, and watch for musl issues on alpine."
Common mistakes
- Choosing alpine blindly and spending hours on a musl compile error.