Traefik Labs Focuses on Attack Surface Reduction to Simplify Container Security

Enterprise security teams are re-evaluating container security strategies as high vulnerability volumes and shifting compliance standards stretch engineering workflows, according to industry data. Research published by theCUBE Research in 2026 revealed that 58% of survey respondents currently rely on vulnerability scanning as a primary software supply chain security control, while 47% rank supply chain security as a top investment priority.

In a recent interview on the AppDevANGLE podcast, first reported by SiliconANGLE, Traefik Labs Chief Executive Officer Sudeep Goswami advocated for an architectural shift away from reactive scanning and toward proactive attack surface reduction. Through an initiative termed Distro Zero, Traefik Labs aims to strip away unnecessary operating system components and runtime dependencies before container images reach production environments.

Goswami noted that traditional scanning solutions focus on detection rather than underlying causes. “The best a scanner is going to be able to do is to tell you faster about a problem that you still have to fix,” Goswami said. “You can buy a faster mop, but somebody has to stop and ask: Where is the water coming from in the first place?” He added that conventional container images package binaries alongside operating system libraries, shells, and package managers, creating significant overhead. “What we’re finding is that the noise factor is huge,” Goswami explained. “It’s almost like that 80/20 analogy … 80% of the CVEs that are coming out are noise, and the 20% is what’s really relevant.”

While distroless container images remove administrative tools such as shells and package managers to hinder attackers, they often retain fundamental dependencies like C libraries, dynamic linkers, and cryptographic components. “Fundamentally, what distroless does is it removes the toolkit that an attacker could use once they get into an environment,” Goswami stated. “It doesn’t remove the code base or the set of things that allow them in in the first place.” Distro Zero seeks to address this gap by delivering applications as self-contained binaries, cutting down the runtime surface that security teams must monitor.

Growing regulatory scrutiny is also accelerating the demand for streamlined container architecture. Data shows that 54% of organizations view National Institute of Standards and Technology (NIST) frameworks as a key pressure affecting release engineering, while 46% highlight the European Union’s Cyber Resilience Act (CRA). Goswami pointed out that emerging requirements like FIPS 140-3 and the EU CRA force organizations to integrate dependency tracking and cryptographic controls directly into continuous integration and delivery pipelines.

“If there was a way to start with the right Distro Zero framework, which also gives FIPS 140-3 compliancy and lets you deal with other regulatory guidelines like the EU CRA, that would be a great architectural choice,” Goswami said. He noted that operational friction frequently escalates as software bills of materials (SBOMs) proliferate across distinct infrastructure layers, including API gateways, AI gateways, and Model Context Protocol (MCP) infrastructure.

To streamline compliance and security reviews, Traefik is working to consolidate ingress, API gateway, AI gateway, and MCP gateway features into a single core binary. “What if there was a unified binary that you deploy once, you certify once, you understand the SBOM, all the dependencies initially upfront?” Goswami said. “As you go through this journey of incremental capabilities, that just becomes a license unlock rather than a binary upgrade.”

This consolidation comes as enterprise traffic expands from standard web APIs to encompass machine learning models and autonomous agents. “Traditionally, it’s been APIs, but now you are adding two more characters to this play, which are agents and models,” Goswami noted. By embedding security and compliance parameters directly into a single infrastructure binary, Traefik aims to help platform engineering teams minimize vulnerability surfaces without adding operational complexity.