Container base images serve as the foundation layer for every containerized application, defining the operating system, libraries, and utilities available to your application at runtime. These images range from full-featured Linux distributions to stripped-down minimal images containing only essential components. Choosing the right base image directly impacts your application's security posture, image size, build time, compatibility, and runtime performance — making it one of the most critical decisions in container architecture. The key mental model: smaller attack surface equals fewer vulnerabilities, but compatibility trade-offs must be carefully evaluated against your specific application dependencies and deployment environment.
What This Cheat Sheet Covers
This topic spans 16 focused tables and 124 indexed concepts, 96 flashcards. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.
A jump-to index of every table row in this cheat sheet.
An interactive map of every table and concept in this topic.
Table 1: Common Base Image Types
Understanding the major families of base images — their size, runtime, and security trade-offs — is the starting point for every container architecture decision.
| Type | Example | Description | |
|---|---|---|---|
FROM alpine:3.21 | • Minimal Linux distribution (~5 MB) using musl libc and BusyBox • popular for small images but requires careful handling of glibc dependencies | ||
FROM debian:trixie-slim | • Stripped Debian variant (~75 MB) removing documentation and uncommon utilities while maintaining glibc compatibility • balanced choice for most applications | ||
FROM ubuntu:24.04 | • Full-featured distribution (~124 MB) with extensive package availability via apt • preferred when compatibility and developer familiarity outweigh size concerns | ||
FROM gcr.io/distroless/base-debian13 | • Google's minimal images (~20 MB) containing only application runtime with no shell, package manager, or OS utilities • maximizes security by eliminating attack surface | ||
FROM scratch | • Empty image (0 bytes) signaling Docker to start from nothing • used exclusively for static binaries compiled with all dependencies embedded | ||
FROM cgr.dev/chainguard/wolfi-base | • Undistro Linux built specifically for containers with glibc, apk package manager, and designed for near-zero CVEs • continuously rebuilt when vulnerabilities discovered | ||
FROM registry.access.redhat.com/ubi9/ubi | • Freely redistributable Red Hat Enterprise Linux base images with enterprise support options • ideal for certified workloads and RHEL-compatible environments | ||
FROM ubuntu/dotnet-aspnet:8.0-chiseled | • Canonical's distroless-style Ubuntu images, trimming up to 80% attack surface using the Chisel tool • glibc-compatible alternative to Google distroless with 5-year Canonical support | ||
FROM amazonlinux:2023 | • AWS-optimized base (~52 MB) with dnf package manager and AWS integration libraries • ideal for EC2/ECS/Lambda workloads; Amazon Linux 2023 is the current recommended version | ||
FROM busybox:1.36-uclibc | • Combines tiny versions of common UNIX utilities into a single 1–2 MB executable • useful for debugging distroless images or building custom minimal images | ||
FROM mcr.microsoft.com/windows/servercore:ltsc2022 | • Full Windows Server base (~3.1 GB) supporting IIS, full .NET Framework, and Windows Server features • required for legacy Windows applications | ||
FROM mcr.microsoft.com/windows/nanoserver:ltsc2022 | • Minimal Windows base (~100 MB) for .NET Core and modern cloud-native apps • lacks full Windows API and GUI components |