Loading page
About this tool
Compare alpine, slim, distroless, scratch and full base images by size, libc, shell and debug tooling — and get a ranked pick.
This tool picks the smallest container base image that still satisfies your workload's real requirements — libc flavour (glibc vs musl vs none), shell access, package manager and CA certificates — comparing scratch, distroless static and base, alpine, debian slim, ubuntu LTS and full debian. It encodes the standard hardening guidance: ship the minimum filesystem your binary needs, because every extra megabyte is pull time and attack surface. Built for backend and platform engineers writing Dockerfiles for Go, Rust, Java, Python and Node services.
Open Container Base Image Chooser on AltFTool — it loads instantly in your browser.
Upload or drag in the file you want to work with.
Adjust the settings and preview the result.
Download the finished file to your device.
Images that cannot run your binary (wrong libc, no interpreter path) are excluded with the exact reason.
Surviving candidates are ordered by approximate uncompressed size, from 0 MB scratch to 117 MB full debian.
Flags missing CA certificates, distroless :debug tags and musl DNS quirks before they bite in production.
Alpine (~8 MB) is a full mini-distribution with a busybox shell, the apk package manager and musl libc; distroless images ship only your app's runtime dependencies — glibc, CA certs and tzdata in distroless/base (~21 MB), or ~2 MB for distroless/static — with no shell or package manager at all. Distroless trades debuggability for a smaller attack surface; its :debug tags add busybox back when you need to exec in.
Because alpine uses musl libc, and a binary dynamically linked against glibc asks for a loader (/lib64/ld-linux-x86-64.so.2) that does not exist there — the kernel reports the missing loader as 'not found'. Fix it by building a static binary, rebuilding against musl, or switching to a glibc base such as debian slim or distroless/base.
Only for fully static binaries, such as Go built with CGO_ENABLED=0 or Rust targeting musl statically. scratch is the reserved empty image — no shell, no CA certificates, no tzdata, no nonroot user — so you must COPY in anything the app needs; distroless/static (~2 MB) adds those basics and is usually the better choice.
Generally yes: fewer packages mean fewer CVEs to patch and fewer tools (shell, curl, package manager) an attacker can use after a compromise, which is why scanners report far fewer findings on distroless and alpine than on full debian or ubuntu. Size is a proxy though, not a guarantee — you still need to rebuild regularly to pick up base-image security updates.