Choose minimal base images and pin versions

Choose a base image built from a trusted source and keep it small: Docker Official Images are a curated collection with clear documentation that are regularly updated, and badges on Docker Hub also mark Verified Publisher and Docker-Sponsored Open Source images. A minimal base image that matches your requirements offers portability and fast downloads, shrinks the size of your image, and minimizes the number of vulnerabilities introduced through the dependencies; consider two types of base image — one for building and unit testing, and another typically slimmer image for production — since a production image often doesn't require build tools such as compilers, build systems, and debugging tools. Images are immutable snapshots, so rebuild your images regularly with updated dependencies, and use the --pull flag to force Docker to check for and download a newer base image even when a version is cached locally. Image tags are mutable: FROM alpine:3.21 resolves to the latest patch version of 3.21, and the same tag can point to a different version months later, which can introduce breaking changes and leaves no audit trail of exact image versions. To secure supply-chain integrity you can pin the base image to a specific digest (FROM alpine:3.21@sha256:...), which guarantees the same image even if the publisher replaces the tag; the trade-off is that digest pinning is tedious to maintain and opts you out of automated security fixes. Scope: base image selection in Dockerfiles. Reviewed October 4, 2026.