Comparison
Golden imagevsImage baking
Golden image
the machine boots already containing the agent, the runtime and the hardening, so start-up is thirty seconds rather than six minutes.
A pre-built machine or container image containing everything common to a fleet, so instances need no configuration at boot. It makes scaling fast and start-up deterministic, and it moves the work into a build pipeline that has to run on a schedule to pick up patches. Its failure mode is a stale image nobody rebuilds, which quietly becomes the oldest and least patched thing in the estate.
Full entry →Image baking
a scheduled job boots a base machine, applies the configuration, snapshots it and publishes a new version every week.
The pipeline that produces golden images: start from a base, run configuration management once, test it, snapshot it, promote it. It is where configuration management survives in an immutable world — run once at build time instead of forever at run time. The cadence is the whole point, since the security value of a golden image comes from being rebuilt, not from being golden.
Full entry →