We Built Distro Zero, the Most Hardened Gateway Image Ever Shipped.
Hardened images are having a moment. Most gateway vendors now ship one, and hardening platforms sell them generically: hardened rebuilds and FIPS variants of software they never wrote a line of code for. Look inside, though, and most are half-baked. The shell is gone, but the C substrate remains. The crypto module is validated, but the application above it was never adapted. The image is stripped, not hardened, and the word "hardened" is doing the work the engineering didn't.
We decided to take the bull by the horns and push the concept all the way to its logical end. Today we are announcing the Distro Zero image: a hardened Traefik Image, and I believe the most accomplished hardened gateway image ever created. That is a big claim, and proving it takes exactly one shell command.
The industry has spent years racing toward "distroless". That race has a finish line, and we just crossed it. Distroless means less. Zero means done.
The Bar We Set
We wrote down a definition and refused to compromise on it:
distro zero (adj.) A container image that ships zero third-party executable content. No shared objects, no libc, no dynamic linker, no shell, no package manager: nothing a distribution would supply. One vendor-built binary, plus inert data such as the standard trust bundle.
Here it is, applied. The entire attack surface of the image we shipped today:
$ docker export $(docker create registry.traefik.io/traefik-hub/traefik-hub:v3-fips-hardened) | tar -t
traefik-hub # the binary.
etc/ssl/certs/ca-certificates.crt # CA trust bundle (data)
etc/nsswitch.conf # name resolution config, one line (data)
usr/share/zoneinfo/... # timezone database (data)
third_party/licenses/... # open-source license texts (data)
tmp/ # empty tmp directory
plugins-storage/ # empty plugin storage directory
That is the whole image, with only the timezone and license entries elided. Count the executables: one. A single static, memory-safe Go binary that we wrote, running as a non-root user. Everything else is inert data or an empty directory. No OpenSSL, no shared objects of any kind, not even an /etc/passwd.
By definition, Distro Zero is more secure than every "minimal" base image and every "distroless" image on the market: even the flagship ones still carry glibc, libssl, and Debian base files. It excludes any gateway whose core is written in C or C++, because a memory-unsafe core cannot exist without the underlying substrate. And it excludes the hardened rebuilds of those images; a rebuild can shrink the foundation and patch it faster, but it cannot eliminate what the application requires to run.
Reaching zero is not a packaging exercise. Anyone can strip an image. The author must stand behind what remains.
The only way to ship zero is to need zero, and the only way to need zero is a runtime where TLS, regex, compression, and parsing live inside one static, memory-safe binary. That is an architectural property, decided ten years ago, in the first commit, when we chose Go.
Why We Built It Now
The math of patching has broken. In the first half of 2026 alone, 35,364 CVEs were published, more than in any full year before 2024. That’s one every 7.4 minutes, on track for 66,000 this year. Roughly a third of known-exploited vulnerabilities are now attacked on or before their disclosure day. "Scan, triage, patch, repeat" is a treadmill that accelerates faster than any team can keep up with.
Meanwhile, regulatory clocks are running on both sides of the Atlantic, and they point directly at gateways. In the United States, the CISA and FBI deadline for memory-safety roadmaps passed on January 1, 2026: memory-unsafe languages are now officially a product-security bad practice, with network-facing and cryptographic code identified as top priorities. A gateway is precisely both.
On September 21, 2026, FIPS 140-2 certificates move to the NIST Historical List. In Europe, the Cyber Resilience Act's (CRA) reporting obligations begin on September 11, 2026, with actively exploited vulnerabilities to be reported to ENISA within 24 hours. Full compliance becomes mandatory on December 11, 2027, with fines of up to 15 million euros or 2.5% of global turnover. The CRA turns secure-by-design into a legal obligation: minimized attack surface, secure defaults, and documented due diligence on every third-party component a product ships.
You cannot out-patch a curve like this. The durable answer is to shrink what must be patched at all. Distro Zero is that answer taken to completion.
Why Nobody Else Can Ship Zero
Two kinds of players sell hardened images today, and each hits a different wall short of zero.
Gateway Vendors
Gateway vendors are locked in by their own core. A runtime built in C or C++ stripped of its operating system must still carry the OS layer to run: a full C library, the dynamic linker, a system cryptographic library, and a dozen supporting components. None written by the vendor, all memory-unsafe, and each with its own upstream and CVE feed: more than 40 CVEs patched in system OpenSSL alone since January 2025, including a CVSS 9.8 pre-authentication stack overflow, plus a dozen in glibc. Not one ever applied to a Distro Zero image, because there is no base layer to patch.
Under the EU CRA, that residue becomes a legal burden: documented due diligence and 24-hour ENISA reporting on every third-party component shipped. A dozen C libraries are a dozen due-diligence files. One binary is one. The vendors cannot fix this by packaging harder. Studies have repeatedly linked roughly 70% of severe vulnerabilities in large C and C++ codebases to memory safety defects, and escaping that class means a rewrite that takes the better part of a decade. I know what that decade costs, because we invested it up front.
Hardening Platforms
Hardening platforms are locked out of the code. They are genuinely good within their perimeter: smaller bases, patches within hours, validated crypto modules swapped in cleanly. But their perimeter ends where the application begins. They harden software they did not write, so they cannot remove the substrate a C application needs, nor can they rework a feature that depends on a non-approved algorithm. Hardening platforms can only vouch for what surrounds the binary, never for what it does. While a rebuild can improve someone else's image, it cannot make it zero.
So the market splits into two camps: one that owns code it cannot fix, and one that fixes code it does not own. Shipping zero requires having written the application in memory-safe code from the first commit.
FIPS Done Whole, Not FIPS Done Half
"FIPS-ready" too often means exactly one change was made: the crypto library was swapped for a validated module, and everyone went home. That is not enough. Features negotiate algorithms, derive keys, and hash tokens in code paths far from the crypto library, and if those paths reach for non-approved algorithms, the certificate underneath changes nothing. FIPS must be implemented globally across the entire codebase, not just in the portion labeled "crypto".
That is where most vendors stop, and where we started. We conducted a deep audit of our entire codebase to build an image that is FIPS-validated at the application level, not only for cryptographic operations. We traced every feature that touches cryptography and adapted the ones that needed it: reworking functionality whose defaults relied on unapproved primitives, enforcing approved algorithms at the feature level, and disabling features that cannot be made compliant rather than letting them silently pass through. None of that is possible by swapping a library, which is exactly why the generic FIPS variants sold by hardening platforms stop at the module.
The foundation is the Go Cryptographic Module v1.0.0, FIPS 140-3 validated under CMVP Certificate #5247, implemented inside the binary and maintained by the team that builds the proxy. The consequence is something no assembled stack can offer: the FIPS boundary and the memory-safe boundary are one in the same. When regulators ask for your memory-safety roadmap, the answer is one sentence: finished before it was asked. When they ask about the FIPS 140-2 sunset: already on 140-3.
One Binary, Proxy to Platform, Anywhere You Run
There is one more consequence of the single-binary architecture, and it changes how you adopt it. The hardened image is not a separate product to migrate to: it is the same Traefik Hub binary, and you can start by running it as a plain drop-in license-free reverse proxy.
From there, API Gateway, AI Gateway, MCP Gateway, and full API Management unlock on that same binary by license, not as a separate download. No new artifact, no revalidation: the posture, provenance, and SBOM your security team approved on day one carry across unchanged as capabilities switch on. You unlock what you need over time with a license, not a migration.
That posture holds wherever the binary lands, including the places that need it most: sovereign clouds, classified networks, anywhere "just pull the latest image" is not a sentence anyone can say. The image is airgap-ready by design, with offline licensing, no runtime fetches, and no SaaS dependency, delivered through a support entitlement and signature-verified from source to deployment.
And because a runtime with no shell removes live debugging, we replaced it with a named team on standby: prioritized remediation from the people who write the code, upgrade validation against your environment, and reference architecture review. The answer to a runtime question is a person, not a prompt.
The Deadlines Are Not Moving
What I will close on is the calendar. September 2026 brings two dates, both under two months away: EU CRA reporting obligations on the 11th, and the FIPS 140-2 sunset on the 21st. December 11, 2027 closes the loop with full CRA compliance, including CE marking. None of these clocks can be negotiated with, and none of them reset.
For years, hardened images were a luxury you could reasonably defer. That era just ended. With the vulnerability curve and the regulatory deadlines converging, a hardened image is no longer an optimization you can skip. It is the baseline. The only decision left is which kind: an image that was stripped and relabeled, or one hardened all the way through by the people who wrote every line it runs. And a word to our European readers: Traefik was born in Europe, and Traefik Labs operates on both sides of the Atlantic, with headquarters in the US and in Europe. The CRA is not a foreign requirement we retrofit for export. It is a home regulation, and we built for it from the start.
The Distro Zero image is available today as part of a Traefik Hub support entitlement. Request a demo, or start a free trial. If your compliance team has September circled in red, come talk to us this quarter, not next.
We spent ten years building toward an image that has nothing left to harden. The deadlines are here. So is the image.
