Traefik Labs has introduced the Distro Zero image, a hardened, vendor-supported secure runtime delivered as Traefik Hub in proxy mode. It gives platform and security teams a container whose entire executable content is a single memory-safe binary, with validated cryptography built inside it and every advanced capability, from API gateway to AI and MCP gateway to full API management, unlocked by license on that same binary.
The launch lands as the vulnerability curve bends steeper. In the first half of 2026 alone, 35,364 CVEs were published, more than in any full year before 2024 and a 49.5 percent jump over the same period last year.
A new CVE now lands roughly every 7.4 minutes, with the year projected to close near 66,000. At the same time, regulatory clocks are running on both sides of the Atlantic: CISA and the FBI have named memory-unsafe languages a product security bad practice for software serving critical infrastructure, prioritizing network-facing code and code that handles cryptography.
In Europe, the Cyber Resilience Act’s reporting obligations begin on September 11, 2026, with full compliance mandatory on December 11, 2027 under fines of up to 15 million euros or 2.5 percent of global annual turnover.
The Distro Zero image is built on three reinforcing pillars. It keeps nothing a distribution would supply: one static Go binary and the standard trust bundle, which is data, not code. Export the image and count the executables: one. Everything else is inert data, from the trust bundle to the timezone database.
Because Traefik has been written entirely in memory-safe Go since its first commit a decade ago, the vulnerability class that studies have repeatedly linked to, roughly 70 percent of severe findings in large C and C++ codebases does not exist at the language level, and there is no memory-unsafe layer beneath the binary.
Related: IBM Earnings Disappoint Amid IT Spending Slowdown
For regulated workloads, cryptography routes through the Go Cryptographic Module v1.0.0, FIPS 140-3 validated, implemented inside the binary and maintained in the source by the team that builds the proxy rather than repackaged from public inputs.
The same hardened, supported binary runs as a drop-in proxy and unlocks API Gateway, AI Gateway, MCP Gateway, and API Management through licensing rather than a separate download. Teams that start with a proxy and later need advanced capabilities have typically had to move to a different artifact, re-validating their security posture at exactly the moment they can least afford to.
As the Cyber Resilience Act and other regulations come into effect, the Distro Zero image provides a secure runtime for API and AI gateways, allowing teams to focus on their core business without worrying about the security of their infrastructure. With its memory-safe binary and validated cryptography, Distro Zero is well-positioned to help organizations meet the increasingly stringent regulatory requirements.
Emile Vauge, CTO of Traefik Labs, said Distro Zero keeps nothing: one memory-safe binary they wrote, with FIPS 140-3 cryptography enforced.
They have achieved this by using a single memory-safe binary, which reduces the attack surface. This is particularly important in the context of ad fraud and other types of cybercrime, where attackers often target vulnerabilities in software.
