Distroless containers only contain your application and its dependencies. In theory, they’re a great security best-practice.