Grab migrated 900+ services from Ubuntu to Distroless container images to reduce CVEs and shrink attack surfaces. The key challenge was that ~400 services lacked Medium Tests (integration tests using Testcontainers that spin up real Docker containers in CI), which were required to safely verify Distroless migrations. An agentic workflow using Claude Code, MCP integrations (GitLab, Glean, Sourcegraph), and a skills-based knowledge system automated test scaffolding and Dockerfile patching at scale. The agent detects eligible services, scaffolds tests, fixes failures, raises draft MRs, and monitors CI pipelines — with humans approving every merge. Over 1.5 months, 100+ medium test MRs were raised, reducing per-service effort from 1–3 engineer-days to ~0.1 days. Distroless adoption grew from 52.7% to 70.8% across 1,408 services between December 2025 and April 2026.
