Your Base Image Is a Supply Chain Decision, Not a Convenience

Your application has a dependency list you audit, pin and scan. It also has a base image containing a few hundred packages you did not choose, cannot easily list, and almost never update.

The FROM line is the largest unreviewed dependency in most container builds.

What you are actually pulling

# How many packages ship in your base?
docker run --rm debian:bookworm dpkg -l | wc -l

For a general-purpose base the answer is often in the hundreds. Each one is code you run in production, written by strangers, updated on their schedule.

A model that works

1. Prefer minimal, purpose-built bases. Distroless, Alpine-based or scratch images ship a fraction of the packages. Fewer packages means fewer CVEs and a smaller blast radius. The trade-off is debugging tooling, which you solve by keeping a debug variant around rather than by shipping curl and bash to production.

2. Pin by digest, not by tag. Tags move. A digest does not. Pinning makes your build reproducible and makes "what changed?" answerable.

3. Scan in CI and gate on it. Tools like Snyk or trivy turn "we hope the base is clean" into a check that fails the build. Gate on fixable, reachable vulnerabilities rather than raw CVE count, or the gate becomes noise and gets disabled.

4. Automate the rebuild. A base image CVE does not require a code change, so nobody remembers to rebuild. A scheduled pipeline that rebuilds and redeploys on base updates closes the gap without human attention.

The uncomfortable part

Even a perfect base image only covers what you started from. Your own layers add packages, your language runtime adds its own dependency tree, and your build stage can leak secrets into layers that never disappear.

Image security is not a scanner. It is a habit: minimal base, pinned digest, scanned on every build, rebuilt on a schedule.

Treat the FROM line with the same suspicion you treat a new transitive dependency, because that is exactly what it is — except it runs with your privileges and ships to every environment you have.