scratch image

Learn the minimal scratch-based image.

The scratch image

scratch is a completely empty base image: no shell, no package manager, not even /etc. It is enough for a statically built Go binary and the image is roughly the binary's size.

FROM scratch
COPY --from=builder /out/app /app
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
ENTRYPOINT ["/app"]

If you make HTTPS requests you must copy the CA certificates too.

distroless and time zones

gcr.io/distroless/static is very close to scratch but includes CA certificates, /etc/passwd and a non-root user. If time zone data is needed it can be embedded in Go:

import _ "time/tzdata"  // adds ~450 KB of time zone data to the binary

Then time.LoadLocation("Europe/Istanbul") works in an empty image too.

Exercise Embedded time zone

Import _ "time/tzdata". Load the location with time.LoadLocation("Europe/Istanbul"); if there is no error, print the location's String().

Show example solution

package main

import (
    "fmt"
    "time"
    _ "time/tzdata"
)

func main() {
    loc, err := time.LoadLocation("Europe/Istanbul")
    if err != nil {
        fmt.Println(err)
        return
    }
    fmt.Println(loc.String())
}

Test yourself

Why doesn't <code>docker exec -it app sh</code> work in a scratch-based container?
- There is no shell (sh) in the image
- The port is closed
- The Go binary blocks it
- The user isn't root
Show answer

There is no shell (sh) in the image — scratch contains only the files you copy; this shrinks the attack surface but makes debugging harder.

Empty base

FROM ____
COPY --from=builder /out/app /app

Show answer

FROM scratch
COPY --from=builder /out/app /app

Base images

golang

Includes the compiler, large
alpine

Small, with a shell
distroless

Shell-less, with certificates
scratch

Completely empty

Next lesson: docker-compose

We Are Enhancing Your Experience

Cookie Preferences

Strictly Necessary Cookies

Analytical Cookies