Stop Shipping Your OS. Ship Only What Runs.

A practical guide to Docker's scratch base image — what it actually is, why it matters for production Go services, and every hidden pitfall that will catch you out. 92% of IT professionals now ship software in containers. The most common source of container vulnerabilities is not your application code — it is the bloated base image sitting underneath it, full of binaries you never asked for and will never use. FROM scratch is Docker's answer to that problem. This article walks through what it actually means, when to use it, and the four things that will silently break your production service if you do not account for them upfront. What actually is FROM scratch ? Every Docker image starts from something. ubuntu:22.04 gives you a full Linux userland. alpine:3.19 gives you a stripped-down but still functional shell environment. scratch gives you absolutely nothing. That is not a metaphor. scratch is a reserved, empty image in Docker. There is no filesystem layer. No shell. No libc. No /bi