# Scaling out Distroless adoption With AI

DevFeed: [Scaling out Distroless adoption With AI](<https://devfeed.tech/articles/scaling-out-distroless-adoption-with-ai-1254.md>)

Original publisher: [Read original article](<https://engineering.grab.com/scaling-out-distroless-adoption-with-ai>)

Author: Jia Yee Chong

Published: 2026-06-22T00:00:00Z

Content type: article

Language: en

Sources: [Grab Tech](<https://devfeed.tech/sources/grab-tech.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [migration](<https://devfeed.tech/topics/migration.md>), [Dockerfile](<https://devfeed.tech/topics/dockerfile.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [make](<https://devfeed.tech/topics/make.md>), [ci](<https://devfeed.tech/topics/ci.md>), [configuration](<https://devfeed.tech/topics/configuration.md>), [Docker](<https://devfeed.tech/topics/docker.md>), [Docker Image](<https://devfeed.tech/topics/docker-image.md>), [Testcontainers](<https://devfeed.tech/topics/testcontainers.md>), [MySQL](<https://devfeed.tech/topics/mysql.md>)

Tags: [artificial-intelligence](<https://devfeed.tech/tags/artificial-intelligence.md>), [ci](<https://devfeed.tech/tags/ci.md>), [containers](<https://devfeed.tech/tags/containers.md>), [devsecops](<https://devfeed.tech/tags/devsecops.md>), [docker](<https://devfeed.tech/tags/docker.md>), [docker-image](<https://devfeed.tech/tags/docker-image.md>), [engineering](<https://devfeed.tech/tags/engineering.md>), [migration](<https://devfeed.tech/tags/migration.md>), [mysql](<https://devfeed.tech/tags/mysql.md>), [security](<https://devfeed.tech/tags/security.md>), [testcontainers](<https://devfeed.tech/tags/testcontainers.md>), [testing](<https://devfeed.tech/tags/testing.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

## AI overview

Grab describes migrating services from heavy base images to Distroless images to reduce security risks and eliminate unnecessary binaries and associated CVEs. The article explains the runtime-failure risks of this migration and presents medium tests using Docker images, Testcontainers, and network proxies to verify configuration and runtime dependencies in CI.

## Source excerpt

Distroless adoption at Grab Grab is migrating from heavy base images to Distroless images to reduce security risks. By limiting each container to the application and its runtime dependencies, we shed non-essential binaries and associated Common Vulnerabilities and Exposures (CVEs). This migration is more than a compliance mandate; it is a strategic security decision to build a more resilient environment. Why Distroless requires rigorous testing Distroless adoption risk: Runtime failure Shifting to Distroless images introduces a critical technical risk: Runtime Failure. A service might build perfectly in Continuous Integration (CI), but fail at the deployment stage due to: Missing shared objects: Binaries might require specific libraries (.so files) present in Ubuntu but absent in Distroless. Implicit links: Third-party tools might expect specific system utilities or directory structures. Testing is required to ensure two things: The service spins up with the correct configuration. All runtime dependencies remain intact. Scaling this verification across thousands of services manually? That would take years, unless we found a way to automate the trust. The testing methodology As we perform changes to the Dockerfile definition of our services, it is important for us to include the corresponding test strategy to ensure that the changes that we make do not introduce a regression to our running services. Assessing the change introduced to our services, the lowest possible testing boundary would be that of what we define as medium tests in Grab. Medium tests in Grab At Grab, we categorize our test suites into 3 main sizes: small, medium and large. Small tests refer to functional tests whereby mocks are introduced via dependency injection. Large tests refer to end-to-end tests that run on actual services in our staging environment where nothing is mocked. Figure 1: Architecture diagram of a medium test environment Medium tests sit between the small and large tests. External