prefer-slim-base

Docker image too big? Switching from full OS base images to slim, alpine, or distroless variants cuts hundreds of megabytes.

On this page

FROM node:22 starts you at roughly a gigabyte before your app contributes a byte — the full image ships compilers, version control, and an entire development userland your service will never call. This rule suggests base image variants that start from what the app needs instead: -slim, -alpine, or distroless.

What the rule catches

Dockerfile — ~1 GB of OS before the app starts

FROM node:22
WORKDIR /app

Scanning this file reports:

ℹ INFO [docker-doctor/prefer-slim-base]
  Base image 'node:22' may be a full-OS distribution. Consider using a slim or alpine alternative.

Why it matters

Every megabyte in the base is pulled on every deploy, stored in every registry copy, scanned by every vulnerability scan — and every package is attack surface and CVE noise regardless of whether your app uses it. The bulk of most images' vulnerability-report volume comes from OS packages the application never touches. Slimmer bases mean faster pulls and cold starts, cheaper storage, and dramatically shorter scan reports.

How to fix it

Prefer tags with -slim, -alpine, or use distroless base images to minimize the default operating system footprint.

Dockerfile — same runtime, ~75% smaller

FROM node:22-slim
WORKDIR /app

Choosing between the variants:

-slim — same distro and libc, minimal package set. The safe default; native modules keep working.
-alpine — smallest mainstream option, but musl libc instead of glibc, which occasionally bites native dependencies.
Distroless (gcr.io/distroless/*) — no shell, no package manager, nothing but the runtime. Smallest attack surface; best applied as the final stage of a multi-stage build.

If a build tool is missing in a slim base, install it in the build stage — not by retreating to the full image for production.

Images pulled from the dhi.io registry (Docker Hardened Images) are minimal by construction, -dev variants included, so this rule skips them.

Rule details

Rule key — docker-doctor/prefer-slim-base
Category — Image Size
Default severity — info
Applies to — Dockerfiles

Explain this rule from the CLI:

npx @docker-doctor/cli@latest rules explain docker-doctor/prefer-slim-base

Change its severity — or turn it off — in your config file:

// docker-doctor.config.ts
export default {
  rules: {
    "docker-doctor/prefer-slim-base": "off",
  },
};

Severity affects the health score: error findings cost more points than warning, and info costs the least.