Comparison
Base imagevsGolden image
Base image
a vulnerability was reported in a library you have never imported, because it came in the operating system underneath your code.
The image your build starts from, contributing an operating system userland and whatever else its author put in. It is the largest single decision about your image's size and attack surface, and it is inherited silently — most of the findings in a scan report belong to it rather than to anything you wrote. Choosing a smaller base is usually the cheapest security work available to a team.
Full entry →Golden image
the machine boots already containing the agent, the runtime and the hardening, so start-up is thirty seconds rather than six minutes.
A pre-built machine or container image containing everything common to a fleet, so instances need no configuration at boot. It makes scaling fast and start-up deterministic, and it moves the work into a build pipeline that has to run on a schedule to pick up patches. Its failure mode is a stale image nobody rebuilds, which quietly becomes the oldest and least patched thing in the estate.
Full entry →