What Is a Base Image? The Foundation of Every Build
A base image is whatever your Dockerfile starts FROM - the foundation layer that everything else stacks on top of.
Every image is built on another image, all the way down to a minimal root. The image you name in FROM is your base image. It determines your starting OS, available tools, attack surface, and size - so picking the right one is one of the most consequential decisions in a Dockerfile.
How a base image is chosen
You pick a base that already has what you need: a language runtime (python:3.12), a slim OS (debian:bookworm-slim), or nothing but your binary (scratch). The closer the base is to your actual need, the smaller and safer the result.
Slim, full, and scratch
- Full images (e.g.
node:20) include build tools - convenient but large. - Slim images (
node:20-slim) strip extras for a smaller footprint. - Alpine images are tiny but use musl libc, which can surprise some binaries.
- scratch is empty - ideal for static binaries with no OS at all.
Smaller base, smaller surface
A smaller base means fewer packages, which means fewer CVEs to patch and a smaller attack surface. It also pulls and starts faster. The cost is convenience: you may have to add tools you assumed were there.
Pin your base image
Avoid bare latest. Pin a specific tag, or better a digest, so builds are reproducible and a surprise upstream change cannot silently break or alter your image.
Base images in CI
Because every job that builds your image pulls the base, caching it pays off repeatedly. Managed runners keep popular base layers warm, so FROM resolves from cache instead of a cold pull on every build.
Key takeaways
- The base image is whatever your Dockerfile starts FROM.
- Smaller bases mean fewer vulnerabilities, less size, and faster pulls.
- Pin the base by tag or digest for reproducible builds.