Skip to content

CONCEPT Cited by 1 source

Golden base image

Definition

A golden base image is a platform-team-maintained, standardised machine image that contains all common infrastructure components (OS hardening, monitoring agents, networking, security tooling) and serves as the shared foundation for all service-specific images. Service teams build on top of the golden base rather than starting from a raw vendor image.

Design properties

  • Centralised ownership: Platform/security/monitoring teams maintain the base; service teams consume it.
  • Immutable + ephemeral: New versions are published (never patched in place); old versions are garbage-collected.
  • Event-driven propagation: Updated golden images automatically trigger downstream service image rebuilds.
  • Validated before distribution: Built-in testing ensures correctness before any downstream consumer can adopt the new version.

Slack's implementation: slack-zero

Slack's slack-zero is the canonical golden base image on the wiki. It is maintained collaboratively by Compute, Security, and Monitoring teams and contains OS baseline + hardening, networking + service discovery, monitoring + security agents, and common tooling. Built with AWS Image Builder using SSM Parameter publishing so downstream pipelines always read the latest version (Source: sources/2026-07-14-slack-shipyard-next-generation-ec2-platform).

Analogy to containers

The golden base image is analogous to a shared base Docker image (FROM company-base:latest) — it provides a standardised, trusted foundation that every service inherits while allowing teams to customise their runtime on top.

Seen in

Last updated · 585 distilled / 1,765 read