# 8. Living with distroless

[← 7. PID 1 and signals](07-pid1-and-signals.md) · [Index](../README.md)

`gcr.io/distroless/java25-debian13:nonroot` gives you: a JRE, glibc, CA certificates, time zone
data, and 25 OS packages in total - against 106 in `eclipse-temurin:25-jre`. No shell, no package
manager, uid 65532. It is the variant recommended in the article, and it changes a few habits.

- **`RUN` is impossible in the final stage.** Do everything - extraction, jlink, training runs - in
  a builder stage with a shell, then `COPY`.
- **`ENTRYPOINT` must be exec form.**
- **`docker exec -it ... sh` does not work.** On Kubernetes use an ephemeral debug container that
  shares the process namespace: `kubectl debug -it <pod> --image=busybox:1.37 --target=app`. With
  Docker: `docker run -it --pid=container:<name> --network=container:<name> busybox`.
- **A `preStop` hook of `exec: ["sh", "-c", "sleep 10"]` fails**, because there is no `sh`. Use the
  native `sleep` action (on by default since Kubernetes 1.30, stable in 1.34). The
  [Kubernetes article](https://ankurm.com/spring-boot-4-kubernetes-probes-graceful-shutdown-cpu-limits-hpa/)
  measures what that failure costs during a rolling update.
- **Tags are the variant.** `:latest` runs as root, `:nonroot` as 65532, `:debug` adds a BusyBox
  shell - useful for a one-off investigation, never for production.