Scaling out Distroless adoption With AI

Summary

Grab is migrating from heavy base images to Distroless images to reduce security risks, despite runtime failures caused by missing shared objects, utilities, or expected directory structures. Its medium tests run services in Docker, leave internal dependencies unmocked through Testcontainers, mock external dependencies with a network proxy, and execute in CI to catch Dockerfile regressions before deployment. For services without this setup, an agentic workflow detects candidates, scaffolds tests, fixes repository-specific failures, raises GitLab merge requests, and monitors CI while processing batches in parallel. Claude Code uses MCP integrations for GitLab, Glean, and Sourcegraph, with guardrails limiting changes to test files and CI configuration and humans reviewing every draft merge request. In roughly 1.5 months, the agent raised more than 100 medium-test merge requests and reduced work for 400 services from 400–1,200 engineer-days to approximately 0.1 days per service; Distroless adoption also grew substantially.

Takeaways

1. 1

   Distroless images can build successfully in CI yet fail at deployment when required .so files, utilities, or directory structures are absent.

2. 2

   Medium tests combine Testcontainers for internal dependencies, a WireMock-like network proxy for external dependencies, and containerized endpoint checks in CI.

3. 3

   The agent retries persistent CI failures only twice before flagging a service for human review, while engineers make the final merge decision.