Comparison
Base imagevsMulti-stage build
Base image
a vulnerability was reported in a library you have never imported, because it came in the operating system underneath your code.
The image your build starts from, contributing an operating system userland and whatever else its author put in. It is the largest single decision about your image's size and attack surface, and it is inherited silently — most of the findings in a scan report belong to it rather than to anything you wrote. Choosing a smaller base is usually the cheapest security work available to a team.
Full entry →Multi-stage build
the compiler, the test framework and the whole toolchain are used in the build and then thrown away, and the shipped image contains one binary.
A build file with more than one FROM, where an early stage does the compiling and a later stage copies only the finished artefact into a clean base. It shrinks images by an order of magnitude and, more importantly, removes the build tooling from production, so a compromised container has no compiler to work with. It is the standard answer to the eight-hundred-megabyte image that ships a package manager to production.
Full entry →