Chapter 1 · Practice 1 of 5

Start from a small, official base image

Why it matters

The base image decides most of your image size and most of the vulnerabilities a scanner will find. Pick it on purpose, not by habit.

Docker recommends images from trusted sources, such as Docker Official Images or Verified Publisher images, and a minimal variant for production.

Variant	Use it when
`-slim`	You want the official language image with less baggage
`-alpine`	You want the smallest image and your native modules work with musl
Distroless	You do not need a shell inside the running container

Name an explicit version tag rather than relying on latest.
Prefer a language image over a full OS image like ubuntu.

Check your choice with docker image ls: if a simple web service is several hundred megabytes, the base image is usually why.

Use official images such as node:24-slim or python:3.13-slim
Name an explicit version tag, never just latest
Test native dependencies before moving to Alpine

Avoid

Full OS images like ubuntu when a language image exists
Random community images with no maintainer or update history