Traefik Labs Unveils Distro Zero: One Memory-Safe Binary, FIPS 140-3 Inside, Proxy to Platform by License

Where "distroless" images still carry a substrate of third-party C libraries, the Distro Zero image ships a single static, memory-safe binary and zero third-party executable content, with FIPS 140-3 validated cryptography enforced at the application layer and advanced gateway capabilities unlocked by license on the same binary

SAN FRANCISCO--(BUSINESS WIRE)--Traefik Labs today introduced the Distro Zero image, a hardened, vendor-supported secure runtime delivered as Traefik Hub in proxy mode. It gives platform and security teams a container whose entire executable content is a single memory-safe binary, with validated cryptography built inside it and every advanced capability, from API gateway to AI and MCP gateway to full API management, unlocked by license on that same binary. No binary swap, no migration, no re-validation as needs grow.

The launch lands as the vulnerability curve bends steeper. In the first half of 2026 alone, 35,364 CVEs were published, more than in any full year before 2024 and a 49.5 percent jump over the same period last year. A new CVE now lands roughly every 7.4 minutes, with the year projected to close near 66,000. At the same time, regulatory clocks are running on both sides of the Atlantic: CISA and the FBI have named memory-unsafe languages a product security bad practice for software serving critical infrastructure, prioritizing network-facing code and code that handles cryptography, and FIPS 140-2 certificates move to the NIST CMVP Historical List on September 21, 2026. In Europe, the Cyber Resilience Act's reporting obligations begin on September 11, 2026, with full compliance mandatory on December 11, 2027 under fines of up to 15 million euros or 2.5 percent of global annual turnover. A gateway sits at the center of all of these mandates. Teams cannot out-patch a curve like this; the durable answer is to shrink what must be patched at all.

The Distro Zero image is the durable answer and is built on three reinforcing pillars.

Distro Zero, Not Distroless

The market is converging on smaller images, and that is the right direction, but stripping a container only changes what surrounds the code, not what the code is made of. Even the leading "distroless" images still carry a distribution in miniature: a full C library, the dynamic linker, a system cryptographic library, and a dozen supporting shared components, none written by the gateway vendor, each with its own upstream, cadence, and CVE feed. Generic hardened rebuilds of those images inherit the same limit: a rebuild can shrink and patch the substrate faster, but it cannot eliminate what the application requires to run. Since January 2025, more than 40 CVEs have been patched in system OpenSSL alone, including a critical pre-authentication stack overflow, alongside more than a dozen in glibc. None of them ever applied to a Distro Zero image, because there is no OpenSSL, no glibc, and no substrate to patch.

The Distro Zero image keeps nothing a distribution would supply: one static Go binary and the standard trust bundle, which is data, not code. Export the image and count the executables: one. Everything else is inert data, from the trust bundle to the timezone database. Anyone can audit it in one command. Because Traefik has been written entirely in memory-safe Go since its first commit a decade ago, the vulnerability class that studies have repeatedly linked to, roughly 70 percent of severe findings in large C and C++ codebases does not exist at the language level, and there is no memory-unsafe layer beneath the binary. What a scanner reports maps to code the vendor writes, audits, and stands behind.

FIPS 140-3 at the Application Layer

For regulated workloads, cryptography routes through the Go Cryptographic Module v1.0.0, FIPS 140-3 validated (CMVP Certificate #5247), implemented inside the binary and maintained in the source by the team that builds the proxy rather than repackaged from public inputs. Traefik Labs conducted a deep audit of the entire codebase to validate FIPS at the application level, not only on cryptographic operations, adapting features whose defaults relied on non-approved primitives, something a crypto-library swap alone cannot achieve. FIPS is enforced by the application, not bolted on beneath it, so the FIPS boundary and the memory-safe boundary are the same. With FIPS 140-2 modules moving to the NIST Historical List in September 2026, stacks resting on aging 140-2 certificates face a re-validation of the cryptography underneath their regulated workloads. Distro Zero customers already have the answer.

One Binary, Proxy to Platform

The same hardened, supported binary runs as a drop-in proxy and unlocks API Gateway, AI Gateway, MCP Gateway, and API Management through licensing rather than a separate download. Teams that start with a proxy and later need advanced capabilities have typically had to move to a different artifact, re-validating their security posture at exactly the moment they can least afford to. With Traefik Hub now offered in proxy mode, there is no migration from proxy to platform: the posture, provenance, SBOM, and cryptographic behavior the security team approved on day one carry across unchanged as new capabilities are switched on.

"Security teams are being asked to defend a growing attack surface with the same resources, and the last thing they want is to re-validate everything because the business needs a new capability," said Sudeep Goswami, Chief Executive Officer of Traefik Labs. "We have removed that trade-off. You install one hardened, supported binary, you get a clean security posture from day one, and you unlock what you need over time with a license, not a migration."

"Distroless removes the package manager and the shell, then keeps the C substrate underneath. Distro Zero keeps nothing: one memory-safe binary we wrote, with FIPS 140-3 cryptography enforced inside it, plus a few files of inert data," said Emile Vauge, founder and Chief Technology Officer of Traefik Labs. "Anyone can strip an image. Only the author can stand behind what remains. Because advanced capabilities are gated by license rather than shipped as a separate artifact, the binary your security team approved is the same binary you keep running as you grow."

distro zero (adj.) A container image that ships zero third-party executable content. No shared objects, no libc, no dynamic linker, no shell, no package manager: nothing a distribution would supply. One vendor-built binary, plus inert data such as the standard trust bundle. Data, not code.

Availability and Support

The Distro Zero image is now available as an early access (EA) release and delivered as part of a support entitlement rather than published to the public registry, signature-verified from source to deployment, and airgap-ready by design, with offline licensing, no runtime fetches, and no SaaS control-plane dependency. Supported customers receive the hardened, private build, prioritized remediation of severe vulnerabilities from the team that writes the code, scheduled upgrade and cutover validation against their own environment, release-candidate validation ahead of general availability, and reference architecture review. For more details, visit https://distrozero.io

About Traefik Labs

Traefik Labs builds cloud-native networking and connectivity software used by development and platform teams worldwide. Its open-source proxy, Traefik Proxy, has been in production for a decade, has surpassed 3.5 billion downloads, and is the default ingress controller in widely adopted Kubernetes distributions. Traefik Hub, the company's commercial platform, unifies API Gateway, AI Gateway, MCP Gateway, and API Management on a single runtime. Traefik Labs is headquartered in both San Francisco, California and Lyon, France. Learn more at traefik.io.