How to Choose a Docker Base Image for Python

When it comes to containerized applications, choosing the right container base image – meaning the foundational image on which you build new, customized container images – is half the battle for success. The base image you choose plays a central role in your application’s security, performance, maintainability and more.

To illustrate the point, this article walks through several approaches to selecting a base image for an application developed in Python, one of the most popular programming languages today. As we’ll see, although Python applications are compatible with virtually any type of container base image, one base image may make more sense for you than another depending on your needs and priorities.

Why choosing the right base image is critical

Before diving into base image options for Python, let’s discuss the numerous reasons why selecting the right base image is so important:

• Performance: The overall size of your base image affects how quickly the image can be downloaded. In addition, the amount of code that the image runs when the container starts impacts the time it takes for your app to get up and running. Both of these factors are key considerations for overall container performance.
• Dependencies: Many applications have dependencies, meaning libraries or other code that they require to operate. If these dependencies are baked into the base image, you don’t have to do as much work to configure the container or customize its contents to fit your app.
• Updates: You’ll want to ensure that your base image is kept up-to-date. That’s easier to do if your base image is based on a software platform or distribution that is actively maintained and regularly patched by third-party developers.
• Security: The more code that is inside your base image, the larger the attack surface of your container. For this reason, base images that include only the code strictly necessary to run your app, and nothing more, are more secure.

As you can see, there is some conflict between these priorities. For example, base images that contain a lot of libraries are more likely to satisfy your application’s dependencies. On the other hand, they may also be riskier from a security perspective, because they could contain libraries you don’t actually need, and which therefore increase your exposure to potential security vulnerabilities.

Given the competing considerations to weigh when selecting a base image, there is rarely an obviously ideal choice. Instead, you’ll need to think strategically about the particular requirements of your application and hosting environment before committing to a particular base image.

Three base image options for Python

As an example of how to factor varying priorities into base image selection, imagine that you have a Python application that you want to run inside a container. For example purposes, we’ll use a very simple Hello World Application whose source consists solely of this line of Python source code:

We’ll name our application hello.py. You can go ahead and run it on the command line if you want with:

The output should, of course, be:

But we don’t want to run the application directly from the command line. We want to run it as a container. And for that, we need to create a Docker image to run the app.

Because Python is a cross-platform language that can run almost anywhere, you can create a containerized Python application using virtually any base image. Still, the base image you choose will impact the way your app operates, how easy it is to maintain and secure and so on.

So, let’s examine three different approaches to Python base images: A lightweight Linux distribution, a standard Linux distribution and a minimal base image built from scratch.

1. Lightweight Linux base images for Python

For a simple Python application with few or no dependencies, you could use a base image that was created using a lightweight Linux distribution. This type of base image provides a minimalist Linux environment for your container to run in. That makes it more secure than a “heavierweight” environment that includes more potential vulnerabilities.

The downside of using a minimalist base image is that if your app does have dependencies, and those dependencies are not built into the base image (which they likely are not if it’s a minimalist image), you’ll need to write more lines of code when creating your image.

But for now, let’s assume your app doesn’t have dependencies. It can run using a lightweight Linux base image, like Alpine, which you can pull for free from Docker Hub. The only thing we need to add on top of the base image in this case is a Python interpreter, because Alpine doesn’t come with Python installed by default.

So, let’s create a Dockerfile that uses Alpine as a base image, installs Python and then runs our app. It would look like this:

Save this file with the name Dockerfile, and make sure your Python app is stored in the same directory as the Dockerfile. Then, build the container with:

This tells Docker to name the container with the tag “hello.”

To run the container, enter:

You should see “Hello world!” printed on your CLI.

If you’re curious how large your new container image is, run the command:

If you used Alpine as a base image, you’ll see that the container image’s size is relatively small – around 52 megabytes:

2. Standard Linux base images for Python

A lightweight Linux distribution like Alpine works well for a simple “Hello World” app that has no dependencies other than Python. But if you had a more complex Python app with a lot of dependencies, Alpine may not be a great choice, because you’d have to install each module on top of the base image.

Instead, you might prefer to use a standard Linux distribution, like Ubuntu. In this case, you can create a container for your Python app using a Dockerfile that looks like this (In this example, we use the Ubuntu 20.04 base image, specifically):

You can go ahead and create a container based on this Dockerfile using the same command as with the Alpine base image:

In this case, we name the image “hello_ubuntu” to differentiate it from the Alpine-based image.

You can run the new container with:

Because we used an Ubuntu base image, the total image size in this case is 147 megabytes – quite a bit larger than our Alpine image:

3. Minimalist base image from scratch

A third way to containerize a Python app is to use a base image that you create from scratch. Under this approach, you don’t use a third-party base image at all. Instead, you generate your own unique base image, then create a container image for your application using your base image. (Technically, there is still a base image involved in this approach – Docker’s “scratch” image – but that is a specialized, extremely minimalist image whose singular purpose is to provide a blank slate for creating brand new base images.)

The advantage of using a base image created from scratch is that it will result in a container that is as small and secure as possible. The main downside is that creating and updating the container requires more effort because you have to compile the Python code into a static binary. This is necessary because you need to be able to execute your application without having a Python interpreter available inside the container.

To compile the Python code to static code, first install cython (which translates Python code into C):

Then, generate C source code based on your Python code (here, we’re using the “hello.py” example program):

Finally, go ahead and compile the code with gcc:

(Note that you may need to modify the preceding command depending on which version of Python you have installed on your system.)

At this point, you should have an executable binary file, called hello, that you can run without the Python interpreter using:

Now, we can create a Dockerfile that defines a container to run this binary:

Build and run the container with commands like:

If you check the size of this container, you’ll see that it’s very, very small – a mere 24 or so kilobytes, which is about 20,000 times smaller than the container we created using the Alpine base image:

So, although creating a base image from scratch for a Python app requires more effort, you get an extremely efficient and (due to its minimalist nature) secure container.