Executive Summary

Most container security work looks at applications and dependencies, and skips the userspace layer that ships with the base image. In practice that layer is BusyBox, inherited implicitly through Alpine and similar bases, so a large share of production containers include it whether developers chose it or not. BusyBox was designed for embedded systems: dozens of utilities (sh, ls, grep, sed, tar, and more) compiled into one C binary reached through symbolic links. A defect in one applet touches every tool in the image, memory-unsafety in C accumulates in that single executable, and patching means rebuilding the entire binary and every downstream image that inherited it. Scanning and patching operate after the userspace is already assembled, so they cannot change the architecture that produced the exposure.

CleanStart replaces BusyBox with CSU (CleanStart Utils), a modular Rust workspace, and separates development and production userspaces. The workspace has three crates: libcleanstart holds shared parsing and execution logic so behaviour stays consistent, cleanstart-utils gives development images a full multi-call utility set and shell with each utility as an independent Rust module (multi-call interface for script compatibility, without shared mutable state or C memory bugs), and cleanimg_init runs as production PID 1 with environment initialisation, variable expansion, application launch, and signal handling. Production images get no shell, no archive or networking utilities, no package managers, no build tools, and no dynamically linked userland binaries unless policy explicitly allows them. Everything is statically compiled, so binary contents are known at build time and cannot pull in host libraries at runtime.