Say which base images you use, how they are chosen, how often images are rebuilt, and that layers are scanned, not just application code. A base image is a large bundle of open source packages, and customers expect it in your inventory.
Why base images get their own question
An application image usually contains far more open source than the application itself: the operating system packages, shared libraries and runtimes. A questionnaire that asks about "open source usage" includes all of it. If your inventory covers language packages alone, your honest answer has a gap.
What a complete answer covers
- Selection. Why this base image, who approves changes and whether you use a minimal one.
- Inventory. Image packages appear in the SBOM, not just application dependencies.
- Scanning. Images are checked for known vulnerabilities before release and rechecked afterward.
- Rebuild cadence. A schedule for pulling updated base layers, plus an out of band path for urgent issues.
- Ownership. A named team that maintains images.
NIST SP 800-218 includes the practice of maintaining a list of approved components with their provenance data and of building binaries from verified source when integrity cannot be confirmed (PW.4.1). Approved base images are that idea applied to containers.
Common weak points
| Weak point | Why it matters |
|---|---|
| Floating tags like latest | The image changes without a reviewed change |
| Old images never rebuilt | Known flaws accumulate in unchanged layers |
| Tools left in the runtime image | More packages to patch, more attack surface |
| Different bases per team | Impossible to answer consistently |
Mention the ones you have fixed and the ones in progress. Customers appreciate precision.
Reply template
Our services run on a small set of approved base images. Image contents are included in our component inventory and scanned before release. Images are rebuilt on a regular schedule and when urgent advisories apply. Runtime images exclude build tooling where practical.
Use "where practical" if it is true and you can explain the exceptions.
A short checklist before you answer
Run through this list with the team that owns images. Do all production services use an approved base? Is the base version recorded in the inventory? Is there a rebuild schedule, and did the last rebuild happen on time? Are there images in production that nobody has rebuilt in a long while? Do runtime images carry compilers, shells or package managers they do not need?
Any "no" becomes a line in your reply with a date, not a reason to leave the question unanswered.
Try it yourself
Click through it at your own pace, or open it full screen.
Open an image in the demo and look at which findings come from the base layer and which from the application. That split is what your answer should describe.
Safeguard scans containers and dependencies and produces SBOMs that include image contents.
Quick check
Do we have to patch every base image finding?
No. Triage by exposure and exploitation. Rebuilding on a schedule clears many findings without individual work.
Is a minimal base image always better?
It usually reduces packages to track, but it can complicate debugging. Choose deliberately and document the choice.
Sources
Last reviewed: 19 October 2026.
