Scratch base image for minimal containers in Docker - Deep Dive

Overview - Scratch base image for minimal containers

What is it?

The Scratch base image is an empty, minimal starting point for building Docker containers. It contains no files, no shell, and no package manager—just a blank slate. Developers use it to create very small containers by adding only what is absolutely necessary. This helps keep container sizes tiny and secure.

Why it matters

Without the Scratch base image, containers often include unnecessary files and tools, making them larger and more vulnerable to security risks. Using Scratch helps reduce the attack surface and speeds up deployment by minimizing image size. This is especially important for microservices and edge devices where resources are limited.

Where it fits

Before learning about Scratch, you should understand basic Docker images and container concepts. After mastering Scratch, you can explore multi-stage builds, container security best practices, and optimizing container size for production.

Mental Model

Core Idea

Scratch is a completely empty container image that lets you build the smallest possible container by adding only what you need.

Think of it like...

Scratch is like an empty box you get to fill yourself, instead of buying a pre-packed box full of stuff you might not want.

┌───────────────┐
│   Scratch     │  ← Empty base image, no files
└──────┬────────┘
       │ Add only your app and dependencies
       ▼
┌───────────────┐
│ Minimal Image │  ← Tiny container with just what you need

Build-Up - 7 Steps

1

Foundation

What is a Docker base image

Concept: Introduces the idea of a base image as the starting point for containers.

A Docker base image is like a template that contains an operating system or environment. When you build a container, you start from a base image and add your application on top. Common base images include Ubuntu, Alpine, and BusyBox, which come with different sizes and tools.

Result

You understand that containers are built layer by layer starting from a base image.

Knowing what a base image is helps you realize why choosing the right one affects container size and security.

2

Foundation

Why container size matters

Concept: Explains the impact of container size on performance and security.

Large containers take longer to download, start slower, and use more disk space. They also have more software that can have bugs or security holes. Smaller containers are faster and safer, especially in cloud or edge environments.

Result

You see why minimizing container size is a key goal in container design.

Understanding the cost of large containers motivates using minimal base images like Scratch.

3

Intermediate

Introducing the Scratch base image

Concept: Scratch is a special base image with zero content, used to build minimal containers.

Scratch contains nothing—not even a shell or package manager. When you use Scratch, you start with an empty container and add only your compiled app and its necessary files. This creates the smallest possible container image.

Result

You can create containers with no extra files beyond what your app needs.

Knowing Scratch is empty helps you understand why you must include everything your app needs explicitly.

4

Intermediate

Building a container from Scratch

🤔Before reading on: do you think you can run shell commands inside a Scratch-based container? Commit to your answer.

Concept: Shows how to build a container using Scratch and explains limitations like no shell.

Example Dockerfile: FROM scratch COPY myapp / CMD ["/myapp"] This copies a compiled binary 'myapp' into the empty image and runs it. Since Scratch has no shell, you cannot run commands like 'sh' or 'bash' inside the container.

Result

You get a tiny container that runs your app directly, but no shell or extra tools.

Understanding Scratch's emptiness clarifies why debugging or interactive use requires different images.

5

Intermediate

When to use Scratch vs other images

🤔Before reading on: do you think Scratch is always the best choice for all container apps? Commit to your answer.

Concept: Explains scenarios where Scratch is ideal and when other base images are better.

Use Scratch when your app is statically compiled and needs no extra tools or libraries. For example, Go or Rust binaries. If your app needs a shell, package manager, or dynamic libraries, use Alpine or Ubuntu instead.

Result

You can choose the right base image based on your app's needs.

Knowing when Scratch fits prevents build failures and runtime errors.

6

Advanced

Multi-stage builds with Scratch for optimization

🤔Before reading on: do you think you can compile your app inside Scratch directly? Commit to your answer.

Concept: Shows how to use multi-stage builds to compile in a full image and copy only the final binary to Scratch.

Example Dockerfile: FROM golang:1.20 AS builder WORKDIR /app COPY . . RUN go build -o myapp FROM scratch COPY --from=builder /app/myapp / CMD ["/myapp"] This compiles the app in a full Go image, then copies only the binary to Scratch, keeping the final image minimal.

Result

You get a tiny production image without build tools or source code.

Understanding multi-stage builds unlocks powerful container size optimization techniques.

7

Expert

Security benefits and pitfalls of Scratch

🤔Before reading on: do you think using Scratch guarantees a secure container? Commit to your answer.

Concept: Explores how Scratch reduces attack surface but requires careful app design to avoid vulnerabilities.

Scratch has no shell or package manager, so attackers have fewer ways to exploit the container. However, if your app has vulnerabilities, Scratch won't protect you. Also, missing debugging tools can make incident response harder. Proper static analysis and testing are essential.

Result

You understand Scratch improves security but is not a silver bullet.

Knowing Scratch's security tradeoffs helps you design safer containers and plan debugging strategies.

Under the Hood

Scratch is literally an empty image with no filesystem layers. When Docker builds a container FROM scratch, it starts with zero files and layers. You add files by copying them in your Dockerfile. At runtime, the container runs only what you provide, with no shell or utilities. This minimal layering reduces size and attack surface.

Why designed this way?

Docker introduced Scratch to give developers full control over container contents and size. Before Scratch, all images had some base OS, adding unnecessary bulk. Scratch lets you build containers from the ground up, ideal for statically compiled languages and microservices. Alternatives with minimal OS exist but are larger.

┌───────────────┐
│   Dockerfile  │
└──────┬────────┘
       │ COPY myapp /
       ▼
┌───────────────┐
│   Scratch     │  ← Empty base image
└──────┬────────┘
       │ Container with only myapp binary
       ▼
┌───────────────┐
│ Running app   │  ← Minimal container runtime

Myth Busters - 4 Common Misconceptions

Quick: Does Scratch include a shell like bash? Commit yes or no before reading on.

Common Belief: Scratch is a minimal Linux OS and includes basic tools like a shell.

Reality: Scratch is completely empty and has no shell, no package manager, no files at all.

Why it matters: Assuming Scratch has a shell leads to failed container runs and confusion during debugging.

Quick: Can you compile your app inside a Scratch container? Commit yes or no before reading on.

Common Belief: You can build and compile your app directly inside a Scratch container.

Reality: Scratch has no tools or compilers; you must build your app elsewhere and copy the binary in.

Why it matters: Trying to compile inside Scratch causes build errors and wastes time.

Quick: Does using Scratch guarantee your container is secure? Commit yes or no before reading on.

Common Belief: Using Scratch makes your container completely secure by default.

Reality: Scratch reduces attack surface but does not fix vulnerabilities in your app code.

Why it matters: Overestimating Scratch's security can lead to neglecting proper app security practices.

Quick: Is Scratch suitable for all types of applications? Commit yes or no before reading on.

Common Belief: Scratch is the best base image for every containerized app.

Reality: Scratch is only suitable for statically compiled apps without dependencies; others need fuller base images.

Why it matters: Using Scratch for incompatible apps causes runtime failures and wasted effort.

Expert Zone

1

Static linking is essential for Scratch containers because dynamic libraries are not present.

2

Debugging Scratch containers requires external tools or special build stages since no shell exists inside.

3

Multi-stage builds are the standard pattern to combine full build environments with minimal final images.

When NOT to use

Avoid Scratch if your app depends on dynamic libraries, shells, or package managers. Use Alpine or Debian base images instead, which provide minimal OS environments with tools.

Production Patterns

In production, teams use multi-stage builds to compile apps in full images and deploy only the binary in Scratch. They combine this with CI/CD pipelines that scan for vulnerabilities and automate size checks.

Connections

Static linking in programming

Scratch containers require statically linked binaries to run without external libraries.

Understanding static linking helps you build apps that run smoothly in empty Scratch containers.

Minimalism in product design

Both Scratch containers and minimalist products focus on including only what is essential.

Recognizing minimalism principles across fields helps appreciate why less can be more in container design.

Lean manufacturing

Scratch containers embody lean principles by eliminating waste (unnecessary files) to improve efficiency.

Knowing lean manufacturing concepts clarifies the value of minimal container images in software delivery.

Common Pitfalls

#1 Trying to run shell commands inside a Scratch container.

Wrong approach:

docker run -it scratch sh

Correct approach:

Use a base image with a shell like Alpine: docker run -it alpine sh

Root cause:

Scratch has no shell or utilities; expecting interactive shell causes errors.

#2 Copying source code and expecting it to build inside Scratch.

Wrong approach:

FROM scratch
COPY . /app
RUN go build -o /app/myapp

Correct approach:

Use multi-stage build:
FROM golang AS builder
COPY . /app
RUN go build -o /app/myapp
FROM scratch
COPY --from=builder /app/myapp /

Root cause:

Scratch lacks compilers and build tools; build must happen in a full image.

#3 Using Scratch for apps that need dynamic libraries.

Wrong approach:

FROM scratch
COPY my_dynamic_app /
CMD ["/my_dynamic_app"]

Correct approach:

Use Alpine or Debian base images that include necessary libraries.

Root cause:

Scratch has no libraries; dynamic apps fail to run without dependencies.

Key Takeaways

Scratch is an empty Docker base image that lets you build the smallest possible containers by adding only what you need.

Using Scratch reduces container size and attack surface but requires your app to be statically compiled and self-contained.

You cannot run shells or build tools inside Scratch; use multi-stage builds to compile apps elsewhere and copy binaries in.

Scratch is ideal for minimal, secure containers but not suitable for apps needing dynamic libraries or shells.

Understanding Scratch helps you optimize container size, improve security, and design efficient cloud-native applications.

Practice

1. What is the main purpose of using the scratch base image in Docker?

easy

A. To automatically install dependencies for your app

B. To include a full Linux operating system inside the container

C. To create a minimal container with only your application and no extra files

D. To provide a graphical user interface for the container

Solution

1. Step 1: Understand what scratch means

   scratch is an empty base image, meaning it has no files or OS inside.

2. Step 2: Identify the purpose of minimal containers

   Using scratch lets you build very small containers by including only your app and its static binaries.

3. Final Answer:

   To create a minimal container with only your application and no extra files -> Option C

4. Quick Check:

   Minimal container = scratch base image [OK]

Hint: Scratch means empty base image for smallest containers [OK]

Common Mistakes:

• Thinking scratch includes a full OS
• Assuming scratch installs dependencies automatically
• Believing scratch provides GUI support

2. Which of the following is the correct way to specify the scratch base image in a Dockerfile?

easy

A. FROM base scratch

B. FROM scratch

C. FROM minimal/scratch

D. FROM scratch:latest

Solution

1. Step 1: Recall Dockerfile syntax for base images

   The correct syntax is FROM <image-name> without extra words.

2. Step 2: Check official usage of scratch

   scratch is a special empty image and is referenced simply as FROM scratch.

3. Final Answer:

   FROM scratch -> Option B

4. Quick Check:

   Base image syntax = FROM scratch [OK]

Hint: Use exactly 'FROM scratch' in Dockerfile [OK]

Common Mistakes:

• Adding tags like :latest to scratch
• Using extra words like 'base' or 'minimal/'
• Incorrect syntax like FROM scratch:latest

3. Given this Dockerfile snippet using scratch:

FROM scratch
COPY myapp /
CMD ["/myapp"]

What will happen if myapp is not a statically compiled binary?

medium

A. The container will fail to run because dynamic libraries are missing

B. The container will run successfully without errors

C. Docker will automatically add required libraries

D. The container will run but with degraded performance

Solution

1. Step 1: Understand scratch image limitations

   scratch has no OS or libraries, so dynamic binaries cannot find needed libraries.

2. Step 2: Analyze what happens with non-static binaries

   Non-statically compiled binaries depend on shared libraries which are missing, causing runtime failure.

3. Final Answer:

   The container will fail to run because dynamic libraries are missing -> Option A

4. Quick Check:

   Non-static binary + scratch = runtime failure [OK]

Hint: Scratch needs static binaries; dynamic ones fail [OK]

Common Mistakes:

• Assuming Docker adds missing libraries automatically
• Thinking container runs fine without libraries
• Believing performance is only affected, not failure

4. You wrote this Dockerfile:

FROM scratch
COPY app /
CMD ["/app"]

But when running the container, it fails with "exec format error". What is the most likely cause?

medium

A. The Dockerfile syntax is incorrect

B. The app file is missing execute permissions

C. The app binary is dynamically linked

D. The app binary is not compiled for the container's CPU architecture

Solution

1. Step 1: Understand "exec format error" meaning

   This error usually means the binary format does not match the CPU architecture.

2. Step 2: Check other possible causes

   Missing execute permission or dynamic linking cause different errors; syntax errors prevent build.

3. Final Answer:

   The app binary is not compiled for the container's CPU architecture -> Option D

4. Quick Check:

   Exec format error = wrong CPU architecture binary [OK]

Hint: Exec format error means binary architecture mismatch [OK]

Common Mistakes:

• Confusing exec format error with permission issues
• Assuming dynamic linking causes exec format error
• Thinking Dockerfile syntax causes this runtime error

5. You want to build a minimal Docker container using scratch that runs a Go application. Which steps should you follow to ensure the container runs correctly?

hard

A. Compile the Go app statically, use FROM scratch, copy the binary, and set CMD

B. Use FROM scratch, copy the Go source code, and run go run inside the container

C. Use FROM alpine, install Go, and compile the app inside the container

D. Compile the Go app dynamically, use FROM scratch, copy the binary, and set CMD

Solution

1. Step 1: Compile Go app statically

   Static compilation bundles all dependencies, so the binary runs without extra libraries.

2. Step 2: Use FROM scratch and copy binary

   Since scratch is empty, copy the static binary and set the command to run it.

3. Final Answer:

   Compile the Go app statically, use FROM scratch, copy the binary, and set CMD -> Option A

4. Quick Check:

   Static binary + scratch base = minimal working container [OK]

Hint: Static binary + FROM scratch + copy + CMD = minimal container [OK]

Common Mistakes:

• Trying to run source code inside scratch
• Using dynamic binaries with scratch
• Using alpine base instead of scratch for minimal size