How to choose a Docker image

Written by the Novosys Academy team · Explainer

The base image is the first line of every Dockerfile, and it decides a lot: size, security, and how easy the app is to debug. Pick it on purpose.

1. Where does it come from?

Prefer official images from Docker Hub, or the publisher's own verified image. Check who maintains it and how recently it was updated.

2. Which tag?

latest is a moving target. It can change under you between two builds. Pin a version, such as python:3.12-slim, so a build today matches a build next month. Keep the pin in version control.

3. How big is it?

Smaller images pull faster and carry fewer packages to patch. Variants like slim and alpine are common choices. Alpine uses a different C library, so test your app on it before you commit.

4. What does it carry?

Every package in an image is something you may have to patch. Scan the image with a tool your team trusts, and rebuild regularly so the base picks up fixes.

Use multi-stage builds

Build with a large image that has the compilers, then copy only the result into a small runtime image. The final image then has no build tools in it:

FROM golang:1.22 AS build
WORKDIR /src
COPY . .
RUN go build -o /app

FROM gcr.io/distroless/static
COPY --from=build /app /app
ENTRYPOINT ["/app"]

A simple checklist: official source, pinned tag, slim variant unless you have a reason, scanned, rebuilt on a schedule.