Scratch base image for minimal containers in Docker - Commands & Configuration

Introduction

Sometimes you want your container to be as small as possible with only your app inside. The scratch base image is an empty starting point that helps you build tiny containers without extra files or software.

When you want to create a container with only your compiled app and no extra system files.

When you need the smallest possible container size to save storage and speed up downloads.

When your app does not need any operating system tools or libraries to run.

When you want to improve security by reducing the attack surface inside the container.

When you are packaging a static binary or a simple script that runs alone.

Config File - Dockerfile

Dockerfile

FROM scratch
COPY hello /hello
CMD ["/hello"]

FROM scratch starts the build from an empty image with no files.

COPY hello /hello adds your compiled app named 'hello' into the container.

CMD ["/hello"] tells the container to run the app when it starts.

Commands

Builds the Docker image named 'hello-minimal' using the Dockerfile in the current folder.

Terminal

docker build -t hello-minimal .

Expected Output

Sending build context to Docker daemon  2.048kB

Step 1/3 : FROM scratch

 ---> 

Step 2/3 : COPY hello /hello

 ---> Using cache

 ---> 3b1f4f5a6c7d

Step 3/3 : CMD ["/hello"]

 ---> Using cache

 ---> 7a8b9c0d1e2f

Successfully built 7a8b9c0d1e2f

Successfully tagged hello-minimal:latest

Runs the 'hello-minimal' container and removes it after it stops to keep your system clean.

Terminal

docker run --rm hello-minimal

Expected Output

Hello, world!

→

--rm - Automatically remove the container when it exits

Shows the size and details of the 'hello-minimal' image to confirm it is very small.

Terminal

docker images hello-minimal

Expected Output

REPOSITORY      TAG       IMAGE ID       CREATED          SIZE

hello-minimal   latest    7a8b9c0d1e2f   10 seconds ago   1.2MB

Key Concept

If you remember nothing else from this pattern, remember: the scratch image is a completely empty container base that lets you build the smallest possible containers by adding only what you need.

Common Mistakes

Trying to run a non-static binary or app that needs system libraries inside a scratch container.

Scratch has no operating system files or libraries, so apps that depend on them will fail to run.

Compile your app as a static binary or use a base image with needed libraries if your app requires them.

Not copying the app file into the container or using the wrong path.

The container will not find the app to run and will exit with an error.

Use COPY with the correct source and destination paths matching your app location and CMD.

Summary

Use FROM scratch in your Dockerfile to start with an empty container image.

Copy only your static binary or app into the container to keep it minimal.

Run the container with docker run and verify the small image size with docker images.

Practice

1. What is the main purpose of using the scratch base image in Docker?

easy

A. To automatically install dependencies for your app

B. To include a full Linux operating system inside the container

C. To create a minimal container with only your application and no extra files

D. To provide a graphical user interface for the container

Solution

1. Step 1: Understand what scratch means

   scratch is an empty base image, meaning it has no files or OS inside.

2. Step 2: Identify the purpose of minimal containers

   Using scratch lets you build very small containers by including only your app and its static binaries.

3. Final Answer:

   To create a minimal container with only your application and no extra files -> Option C

4. Quick Check:

   Minimal container = scratch base image [OK]

Hint: Scratch means empty base image for smallest containers [OK]

Common Mistakes:

• Thinking scratch includes a full OS
• Assuming scratch installs dependencies automatically
• Believing scratch provides GUI support

2. Which of the following is the correct way to specify the scratch base image in a Dockerfile?

easy

A. FROM base scratch

B. FROM scratch

C. FROM minimal/scratch

D. FROM scratch:latest

Solution

1. Step 1: Recall Dockerfile syntax for base images

   The correct syntax is FROM <image-name> without extra words.

2. Step 2: Check official usage of scratch

   scratch is a special empty image and is referenced simply as FROM scratch.

3. Final Answer:

   FROM scratch -> Option B

4. Quick Check:

   Base image syntax = FROM scratch [OK]

Hint: Use exactly 'FROM scratch' in Dockerfile [OK]

Common Mistakes:

• Adding tags like :latest to scratch
• Using extra words like 'base' or 'minimal/'
• Incorrect syntax like FROM scratch:latest

3. Given this Dockerfile snippet using scratch:

FROM scratch
COPY myapp /
CMD ["/myapp"]

What will happen if myapp is not a statically compiled binary?

medium

A. The container will fail to run because dynamic libraries are missing

B. The container will run successfully without errors

C. Docker will automatically add required libraries

D. The container will run but with degraded performance

Solution

1. Step 1: Understand scratch image limitations

   scratch has no OS or libraries, so dynamic binaries cannot find needed libraries.

2. Step 2: Analyze what happens with non-static binaries

   Non-statically compiled binaries depend on shared libraries which are missing, causing runtime failure.

3. Final Answer:

   The container will fail to run because dynamic libraries are missing -> Option A

4. Quick Check:

   Non-static binary + scratch = runtime failure [OK]

Hint: Scratch needs static binaries; dynamic ones fail [OK]

Common Mistakes:

• Assuming Docker adds missing libraries automatically
• Thinking container runs fine without libraries
• Believing performance is only affected, not failure

4. You wrote this Dockerfile:

FROM scratch
COPY app /
CMD ["/app"]

But when running the container, it fails with "exec format error". What is the most likely cause?

medium

A. The Dockerfile syntax is incorrect

B. The app file is missing execute permissions

C. The app binary is dynamically linked

D. The app binary is not compiled for the container's CPU architecture

Solution

1. Step 1: Understand "exec format error" meaning

   This error usually means the binary format does not match the CPU architecture.

2. Step 2: Check other possible causes

   Missing execute permission or dynamic linking cause different errors; syntax errors prevent build.

3. Final Answer:

   The app binary is not compiled for the container's CPU architecture -> Option D

4. Quick Check:

   Exec format error = wrong CPU architecture binary [OK]

Hint: Exec format error means binary architecture mismatch [OK]

Common Mistakes:

• Confusing exec format error with permission issues
• Assuming dynamic linking causes exec format error
• Thinking Dockerfile syntax causes this runtime error

5. You want to build a minimal Docker container using scratch that runs a Go application. Which steps should you follow to ensure the container runs correctly?

hard

A. Compile the Go app statically, use FROM scratch, copy the binary, and set CMD

B. Use FROM scratch, copy the Go source code, and run go run inside the container

C. Use FROM alpine, install Go, and compile the app inside the container

D. Compile the Go app dynamically, use FROM scratch, copy the binary, and set CMD

Solution

1. Step 1: Compile Go app statically

   Static compilation bundles all dependencies, so the binary runs without extra libraries.

2. Step 2: Use FROM scratch and copy binary

   Since scratch is empty, copy the static binary and set the command to run it.

3. Final Answer:

   Compile the Go app statically, use FROM scratch, copy the binary, and set CMD -> Option A

4. Quick Check:

   Static binary + scratch base = minimal working container [OK]

Hint: Static binary + FROM scratch + copy + CMD = minimal container [OK]

Common Mistakes:

• Trying to run source code inside scratch
• Using dynamic binaries with scratch
• Using alpine base instead of scratch for minimal size