Scaling Distroless Adoption with AI
Grab accelerates Distroless migration using AI to reduce security risks
1Strategic Importance of Distroless Migration
Grab is transitioning from Ubuntu-based heavy images to Distroless to enhance container security. This move eliminates unnecessary binaries and associated CVEs, aiming to create a more resilient environment. The minimalist approach containing only application and runtime dependencies represents a strategic decision beyond compliance requirements.
2Critical Nature of Runtime Risks
Distroless migration carries significant technical risks like runtime failures. While services might build successfully in CI, they can fail during deployment due to missing shared objects or implicit links. Comprehensive test strategies are essential to detect these risks.
3Role of Medium Tests
In Grab's three-tier test hierarchy, medium tests occupy a critical position. These tests run services as Docker images, mocking external dependencies with proxies like WireMock while validating real database connections through Testcontainers.
4Benefits of CI/CD Integration
Integrating medium tests into CI pipelines ensures Distroless changes are detected before reaching production. This approach creates a secure foundation for automatic Merge Request approvals and CD triggers.
5Test Infrastructure Barrier
The biggest obstacle in the Distroless migration campaign is the lack of medium test infrastructure in about 400 services. Unique dependency combinations make manual setup extremely tedious for each service.
6Emergence of AI Solution
Grab engineers recognized AI's potential for creating medium test scaffolds. Deterministic success criteria (CI pipeline turning green) and clear deliverables made AI an ideal solution for this task.
7Pilot Implementation Success
The AI agent's initial trial delivered successful results for 20 services in approximately two workdays. This pilot proved the agent could both create test scaffolds and validate Distroless changes didn't cause regressions.
8Skill-Based Approach
Skills based on Grab's internal test SDK enabled the AI agent to identify service dependencies, create test containers, and update environment configurations. This knowledge base provided a repeatable workflow instead of treating each service from scratch.
9Multi-Phase Workflow
The DevSecOps team developed an orchestrator called Entrypoint Skill, automating the AI agent's candidate detection, scaffolding, error fixing, and CI verification steps. This multi-phase approach enhanced process scalability.
10Claude Code Integration
Anthropic's Claude Code tool processed services in batches to accelerate Distroless migration. The agent can prioritize deployable services and resolve complex dependency structures.
11Scalable Results
The AI-assisted approach significantly increased Grab's Distroless migration speed. A process that would take years manually was reduced to weeks through automation. This success highlights the potential at the intersection of DevOps and AI.
12Future DevOps Paradigm
Grab's experience shows AI-powered automation isn't limited to Distroless migration. Similar approaches can be applied to other repetitive infrastructure tasks, offering new opportunities for engineering teams to focus on value-creating work.
Original article: Grab Tech — Distroless Geçişinde AI ile Ölçeklenebilirlik