containingfromscratch

Containingfromscratch is a term used in containerization to describe the practice of building container images from a minimal, empty base image, often associated with the special image known as scratch. The approach emphasizes including only the elements strictly necessary to run an application, avoiding dependencies from a full operating system distribution.

In practice, containingfromscratch involves assembling images that contain the application binaries and any statically linked libraries, while excluding common package managers and large runtime environments. A typical workflow uses a multi-stage build: one stage compiles or prepares the application in a builder image, and a final stage copies only the resulting artifacts into the scratch-based base. This can result in extremely small images with a reduced attack surface and improved reproducibility.

Common techniques supporting containingfromscratch include statically linked binaries, careful selection of runtime dependencies, and the use of minimal or specialized base images such as distroless variants. The approach is popular in environments requiring tight security controls, offline deployment, or precise dependency management, though it can introduce complexity in packaging, debugging, and maintenance.

Advantages of containingfromscratch include smaller image sizes, lower risk from included libraries, and clearer separation between application code and metadata. Challenges include limited tool availability inside the image, more intricate build processes, and language runtimes that do not easily support static linking. While not suitable for every project, containingfromscratch remains a notable technique for achieving highly lean, portable container images.

See also:

- Docker

- container image

- FROM scratch

- distroless

- static linking